0817ebba1e998e81e7c1173f5410d13b2e401396c37a490991418241baab2d38

Analysis

max time kernel
122s
max time network
156s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:08

Target

wintaylor2.1/Programs/Imager/boost_date_time-vc90-mt-1_39.dll
Size

44KB
MD5

87b3a5fe9791762b4b1f8494cb935096
SHA1

e621f1509842b417e1e5115ff57ed8f2282f951d
SHA256

817b4dd43fa228e42daac2e74c6295b0b2d52098c4e5383a5f0dd5900dd3c28d
SHA512

5f4ee2cca103542e83e0a88c23786eb87adc10d34d0ec82a9d91b491b139474615ecf4a307d675c3d1ca5696335cbd5a1e99dab8cfb7db2a01496360eaf9aaf9
SSDEEP

768:8hf/Sv47hGF9j1LWtbK29tnLHLwJRiaOyfOSgG:WiT1LW3jLH0JMaOyUG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2308	2124	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 2124	2592	rundll32.exe	29
PID 2592 wrote to memory of 2124	2592	rundll32.exe	29
PID 2592 wrote to memory of 2124	2592	rundll32.exe	29
PID 2592 wrote to memory of 2124	2592	rundll32.exe	29
PID 2592 wrote to memory of 2124	2592	rundll32.exe	29
PID 2592 wrote to memory of 2124	2592	rundll32.exe	29
PID 2592 wrote to memory of 2124	2592	rundll32.exe	29
PID 2124 wrote to memory of 2308	2124	rundll32.exe	30
PID 2124 wrote to memory of 2308	2124	rundll32.exe	30
PID 2124 wrote to memory of 2308	2124	rundll32.exe	30
PID 2124 wrote to memory of 2308	2124	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\wintaylor2.1\Programs\Imager\boost_date_time-vc90-mt-1_39.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\wintaylor2.1\Programs\Imager\boost_date_time-vc90-mt-1_39.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 232
    3⤵
    - Program crash
    PID:2308