f94ac83ca87f16beb8dadebb57fc564a69c32416df82f5533699a395414356d1

Analysis

max time kernel
118s
max time network
140s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
01/10/2023, 15:55

Target

Astolfo-Beta/natives/jnidispatch_jna4.4.dll
Size

240KB
MD5

68bf293ed84fec43a17dbc830b6001c1
SHA1

e2841508e29f91c168c0a620c57cec387f681a6c
SHA256

19e394e5d7a64f1e5063043f6f8d23243db22ff87d67e9e930bd13f8b12bf275
SHA512

31679b608c01138c97dd0cb6692a00359e398623097650b72a8f4f2701955232657431df41dc3b1f5681de0c30ae6357d1d8343c6124532f2a067210bd1c9fb8
SSDEEP

6144:mGWyWK+wrp1cJakX7dHmLm6rj6vPhxnZKF13nMH32fHy0AXN3:mGW5PwNNrCPhNynMX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2200	1704	rundll32.exe	28
PID 1704 wrote to memory of 2200	1704	rundll32.exe	28
PID 1704 wrote to memory of 2200	1704	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Astolfo-Beta\natives\jnidispatch_jna4.4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1704 -s 84
  2⤵
  PID:2200