1c0b9425bb2f4e39eb64cae968fc3c9ea83f9067dd95db6adb616e7d7f71f322

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 00:27

Target

ConsoleMD/Retro/ConsoleMDChannel32.dll
Size

140KB
MD5

98a72e84185e781b5b0b0060fc34a58d
SHA1

4456fcbd8de7be5aefb3a5c20b455f2643e029de
SHA256

288b7387b3934857d6cf5ce8050121dad05b400e6bf9456aabf1b2fb3698013b
SHA512

e12a5918aef5b1aec9537a49b386f108a17082de7716335cd022635a83041d1785e1b1de66d9ee986eb240c3d61d6c096386764ac5cd4aa34d1ee40c5fe54882
SSDEEP

1536:p0bzJ5HjmQ8ePhicUmUEEDUw69+ligQOVkIRyvYtfqHnRFLtqdATygY8ZTzYWKWI:p0b5XMB9EQATV52DAg0FueaeTs9h4rA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1580	2136	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 2136	1716	rundll32.exe	28
PID 1716 wrote to memory of 2136	1716	rundll32.exe	28
PID 1716 wrote to memory of 2136	1716	rundll32.exe	28
PID 1716 wrote to memory of 2136	1716	rundll32.exe	28
PID 1716 wrote to memory of 2136	1716	rundll32.exe	28
PID 1716 wrote to memory of 2136	1716	rundll32.exe	28
PID 1716 wrote to memory of 2136	1716	rundll32.exe	28
PID 2136 wrote to memory of 1580	2136	rundll32.exe	29
PID 2136 wrote to memory of 1580	2136	rundll32.exe	29
PID 2136 wrote to memory of 1580	2136	rundll32.exe	29
PID 2136 wrote to memory of 1580	2136	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ConsoleMD\Retro\ConsoleMDChannel32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ConsoleMD\Retro\ConsoleMDChannel32.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 224
    3⤵
    - Program crash
    PID:1580