0817ebba1e998e81e7c1173f5410d13b2e401396c37a490991418241baab2d38

Analysis

max time kernel
122s
max time network
143s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:08

Target

wintaylor2.1/Programs/Imager/boost_filesystem-vc90-mt-1_39.dll
Size

66KB
MD5

57dafae254087b961bec6f9c5a16c6cc
SHA1

bf64569095ea364e21efe9b743ed3ee9af6e6286
SHA256

9ac67e8917375b6817829ea866e06607b239a49e0d5e5000d248b1a51b507349
SHA512

8b7d9d7be7908a2e582a14241888cf0d798b7fb3abfd0fa367da5210e8cb9f83ede71c4d63c5cdec55ee76f4c1059d4448dbca7dc6592a8408f61de1813c323c
SSDEEP

768:rJvdjbmb6lpyTXL0/Q32b+ZF6/18qPqyg5Y3+gH7qlLRG7NEozIt6lGOKEcHZSYv:rp7uTXLu+ZFbwH7u0NiCGOK8Y2vH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2636	2796	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2796	2800	rundll32.exe	29
PID 2800 wrote to memory of 2796	2800	rundll32.exe	29
PID 2800 wrote to memory of 2796	2800	rundll32.exe	29
PID 2800 wrote to memory of 2796	2800	rundll32.exe	29
PID 2800 wrote to memory of 2796	2800	rundll32.exe	29
PID 2800 wrote to memory of 2796	2800	rundll32.exe	29
PID 2800 wrote to memory of 2796	2800	rundll32.exe	29
PID 2796 wrote to memory of 2636	2796	rundll32.exe	30
PID 2796 wrote to memory of 2636	2796	rundll32.exe	30
PID 2796 wrote to memory of 2636	2796	rundll32.exe	30
PID 2796 wrote to memory of 2636	2796	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\wintaylor2.1\Programs\Imager\boost_filesystem-vc90-mt-1_39.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\wintaylor2.1\Programs\Imager\boost_filesystem-vc90-mt-1_39.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 236
    3⤵
    - Program crash
    PID:2636