998fe1bc6d19fac4a560e00a038c487fb79c14979b2929e0d7db395030bd6945

Analysis

max time kernel
122s
max time network
156s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 14:48

Target

wintaylor2.1/Programs/Imager/boost_thread-vc90-mt-1_39.dll
Size

45KB
MD5

74604a4cdb0e33ac87641b93da55ea15
SHA1

5bc1f47cc9c97d7f3db9607b7984e902ab1010bf
SHA256

5f070f3687847fa532853641f66a3a94859af54cdd730c9d273ac5be2a127de0
SHA512

6d3391fddb6011a9659d92a767028a8cec43e6d294eaf847e1347d04be5758d7450811f018f98603202be26d2417e946aff34f922c99dd0cb61f790400de0e43
SSDEEP

768:dTCRrFrZdFAhbbXzI7BudcZQEBVobqOyDOpzrP/9VgMEJLOw28U:8RFr76bXs7wdcZRSqOyDOpzrP/9VgMEl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2664	2780	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 2780	1852	rundll32.exe	29
PID 1852 wrote to memory of 2780	1852	rundll32.exe	29
PID 1852 wrote to memory of 2780	1852	rundll32.exe	29
PID 1852 wrote to memory of 2780	1852	rundll32.exe	29
PID 1852 wrote to memory of 2780	1852	rundll32.exe	29
PID 1852 wrote to memory of 2780	1852	rundll32.exe	29
PID 1852 wrote to memory of 2780	1852	rundll32.exe	29
PID 2780 wrote to memory of 2664	2780	rundll32.exe	31
PID 2780 wrote to memory of 2664	2780	rundll32.exe	31
PID 2780 wrote to memory of 2664	2780	rundll32.exe	31
PID 2780 wrote to memory of 2664	2780	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\wintaylor2.1\Programs\Imager\boost_thread-vc90-mt-1_39.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\wintaylor2.1\Programs\Imager\boost_thread-vc90-mt-1_39.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 232
    3⤵
    - Program crash
    PID:2664