f4d72516e3e60d2cd3a103c227be0dd923578e932bec9121b6d134d96b4d0984

Analysis

max time kernel
122s
max time network
145s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:11

Target

Programs/Imager/boost_date_time-vc90-mt-1_39.dll
Size

44KB
MD5

87b3a5fe9791762b4b1f8494cb935096
SHA1

e621f1509842b417e1e5115ff57ed8f2282f951d
SHA256

817b4dd43fa228e42daac2e74c6295b0b2d52098c4e5383a5f0dd5900dd3c28d
SHA512

5f4ee2cca103542e83e0a88c23786eb87adc10d34d0ec82a9d91b491b139474615ecf4a307d675c3d1ca5696335cbd5a1e99dab8cfb7db2a01496360eaf9aaf9
SSDEEP

768:8hf/Sv47hGF9j1LWtbK29tnLHLwJRiaOyfOSgG:WiT1LW3jLH0JMaOyUG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2636	2688	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2688	2716	rundll32.exe	30
PID 2716 wrote to memory of 2688	2716	rundll32.exe	30
PID 2716 wrote to memory of 2688	2716	rundll32.exe	30
PID 2716 wrote to memory of 2688	2716	rundll32.exe	30
PID 2716 wrote to memory of 2688	2716	rundll32.exe	30
PID 2716 wrote to memory of 2688	2716	rundll32.exe	30
PID 2716 wrote to memory of 2688	2716	rundll32.exe	30
PID 2688 wrote to memory of 2636	2688	rundll32.exe	31
PID 2688 wrote to memory of 2636	2688	rundll32.exe	31
PID 2688 wrote to memory of 2636	2688	rundll32.exe	31
PID 2688 wrote to memory of 2636	2688	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Programs\Imager\boost_date_time-vc90-mt-1_39.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Programs\Imager\boost_date_time-vc90-mt-1_39.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 232
    3⤵
    - Program crash
    PID:2636