7411c9840d6323a40eee89d2b52dedd12b13486b955d6e84d6221ea312b3ae80

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
29/08/2023, 08:35

Target

download-stbl-win(V(us))/mod/bin/jli.dll
Size

155KB
MD5

73a76ec257bd5574d9db43df2a3bb27f
SHA1

2c9248eae2f9f5f610f6a1dfd799b0598da00368
SHA256

8f19b1ba9295f87e701c46cb888222bb7e79c6ee74b09237d3313e174ae0154f
SHA512

59ecd5fcf35745bdadcdb94456cb51bb7ea305647c164fe73d42e87f226528d1a53ce732f5ec64ce5b4581fa8a17cfbfdc8173e103ae862d6e92eb3ad3638518
SSDEEP

3072:gLkNbBRaz4rQWiG6wMz9/S3en9pHUw06TBfkqI44:rNbB4Mcnv7z6en9pj06TB6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1092	1896	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 1896	1080	rundll32.exe	28
PID 1080 wrote to memory of 1896	1080	rundll32.exe	28
PID 1080 wrote to memory of 1896	1080	rundll32.exe	28
PID 1080 wrote to memory of 1896	1080	rundll32.exe	28
PID 1080 wrote to memory of 1896	1080	rundll32.exe	28
PID 1080 wrote to memory of 1896	1080	rundll32.exe	28
PID 1080 wrote to memory of 1896	1080	rundll32.exe	28
PID 1896 wrote to memory of 1092	1896	rundll32.exe	29
PID 1896 wrote to memory of 1092	1896	rundll32.exe	29
PID 1896 wrote to memory of 1092	1896	rundll32.exe	29
PID 1896 wrote to memory of 1092	1896	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\download-stbl-win(V(us))\mod\bin\jli.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\download-stbl-win(V(us))\mod\bin\jli.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 228
    3⤵
    - Program crash
    PID:1092