0817ebba1e998e81e7c1173f5410d13b2e401396c37a490991418241baab2d38

Analysis

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 14:08

Target

wintaylor2.1/Programs/Imager/boost_regex-vc90-mt-1_39.dll
Size

600KB
MD5

efd456bf004bbba33f676cb2655914de
SHA1

c1980ab11ef251dff39dd9be83caf13235445d4a
SHA256

8e911da609bee68e2b568ed10d426c855470e09361a9e44e7953e8e371859040
SHA512

7df50382c38a2c82f4102bfb54e4d1c71328fde93f708139a6b0b5bd1f0171a461246da8559c6e2081273d078fdae39671e917444bc6b7cd1ead9abd277a88f0
SSDEEP

12288:3m0gIJXCJUISycMtuVVdiT+r6FWZjMiA1jj/Wt3t39L7HQGZs:3mVUI5WxSWZgjWtd39L7HQG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2624	2752	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2752	2652	rundll32.exe	29
PID 2652 wrote to memory of 2752	2652	rundll32.exe	29
PID 2652 wrote to memory of 2752	2652	rundll32.exe	29
PID 2652 wrote to memory of 2752	2652	rundll32.exe	29
PID 2652 wrote to memory of 2752	2652	rundll32.exe	29
PID 2652 wrote to memory of 2752	2652	rundll32.exe	29
PID 2652 wrote to memory of 2752	2652	rundll32.exe	29
PID 2752 wrote to memory of 2624	2752	rundll32.exe	30
PID 2752 wrote to memory of 2624	2752	rundll32.exe	30
PID 2752 wrote to memory of 2624	2752	rundll32.exe	30
PID 2752 wrote to memory of 2624	2752	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\wintaylor2.1\Programs\Imager\boost_regex-vc90-mt-1_39.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\wintaylor2.1\Programs\Imager\boost_regex-vc90-mt-1_39.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 232
    3⤵
    - Program crash
    PID:2624