fe07bb79c5f2bbb2043c0887db7662b15b4ca20fe20f6e951242cc63868177da

Resubmissions

19/09/2023, 21:23

19/09/2023, 21:22

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
19/09/2023, 21:22

Target

Rc7 - Copy/Rc7/RC7.dll
Size

29KB
MD5

4fb0434430acda70d5f7bc26e0bf7e23
SHA1

32b40693bf32c0c7f2663e77974e501a4cd69b16
SHA256

c6f53a691aa884f37eca99426f6d4a7155851590fab968fb7da27e8da51c385b
SHA512

a7cc5d459b27f6d12154ecc8b36d0dc61636ce6d3e13cf3ab7de013f55f1e8622c00ee8853a4b06151aada3efa8fa1ee94e16a6219b003ffd6be19f5c525bf71
SSDEEP

384:mzJ1xy9pZGPTF34/fuJC56dCaIQF0qJ6I6leuTxB/cwdcTNTCZt6T:cQvfyalQLUhUyBU/RCf6T

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2592	1100	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 1100	2260	rundll32.exe	28
PID 2260 wrote to memory of 1100	2260	rundll32.exe	28
PID 2260 wrote to memory of 1100	2260	rundll32.exe	28
PID 2260 wrote to memory of 1100	2260	rundll32.exe	28
PID 2260 wrote to memory of 1100	2260	rundll32.exe	28
PID 2260 wrote to memory of 1100	2260	rundll32.exe	28
PID 2260 wrote to memory of 1100	2260	rundll32.exe	28
PID 1100 wrote to memory of 2592	1100	rundll32.exe	29
PID 1100 wrote to memory of 2592	1100	rundll32.exe	29
PID 1100 wrote to memory of 2592	1100	rundll32.exe	29
PID 1100 wrote to memory of 2592	1100	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Rc7 - Copy\Rc7\RC7.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Rc7 - Copy\Rc7\RC7.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 216
    3⤵
    - Program crash
    PID:2592