9d5a6f8128c1aa59e04a4a32817f505be6fbdce63e5dd70f12706b587790b5a0

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01/06/2023, 07:10

Target
parachute.dll
Size 362KB
Sample230601-hzev3ada87
SHA256 9d5a6f8128c1aa59e04a4a32817f505be6fbdce63e5dd70f12706b587790b5a0
MD5 637a93e696044ba0dc752d4611c83955
SHA1 b34d01c283978871d8370f11c5747c25dd678931
SHA512 9b74c6326a8aa72ef3c2af3d8882231d87f7c3300f6214658ae6a92706cba259a90d02eac653618b2ede4f16800392639a89b5bed3d715a3986572e7f2d1d55e
SSDEEP 6144:PLh9nrxRw13UyU2G8g1QYYZTDt3n2x+Bdv5zs7iBsTYrPlUEYD/QzkRWAFctOp6E:TInTDtXF15zs7iyZ/0tUS1CU3BJbwP
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1280	1300	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 1300	1344	rundll32.exe	28
PID 1344 wrote to memory of 1300	1344	rundll32.exe	28
PID 1344 wrote to memory of 1300	1344	rundll32.exe	28
PID 1344 wrote to memory of 1300	1344	rundll32.exe	28
PID 1344 wrote to memory of 1300	1344	rundll32.exe	28
PID 1344 wrote to memory of 1300	1344	rundll32.exe	28
PID 1344 wrote to memory of 1300	1344	rundll32.exe	28
PID 1300 wrote to memory of 1280	1300	rundll32.exe	29
PID 1300 wrote to memory of 1280	1300	rundll32.exe	29
PID 1300 wrote to memory of 1280	1300	rundll32.exe	29
PID 1300 wrote to memory of 1280	1300	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\parachute.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\parachute.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 224
    3⤵
    - Program crash
    PID:1280