33b1cc24f787e0879be88253b5c445f9d4f9b0d8d678049dbf78fcdb94b65fe7

Analysis

max time kernel
121s
max time network
141s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 14:17

Target

Tool_1CD_2016v030_edit_mode/icuuc40.dll
Size

928KB
MD5

a13ff2aa557d06f7a3ee4f12b1985297
SHA1

b13129664814110d67cda2bed7ceae33f7d491a3
SHA256

b65a163d16450d501c2c89010c505ad6d9c3aa99c6aac7a5fdd94f930f39a5e7
SHA512

e224960dcbabea1d0a7cffa920aa0e20b51089b2ca70d77c0377e02231ed5934e69c0017864c47c6f93272012e8c9c734f773951af168c977f30555686519ff5
SSDEEP

24576:n7auM7j7SfQvu75jh7NsYcaiLKkkkkkkBbiY9AM:7RyHbu38YqM

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2860	2620	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	Process	procid_target
PID 1636 wrote to memory of 2620	1636	rundll32.exe	29
PID 1636 wrote to memory of 2620	1636	rundll32.exe	29
PID 1636 wrote to memory of 2620	1636	rundll32.exe	29
PID 1636 wrote to memory of 2620	1636	rundll32.exe	29
PID 1636 wrote to memory of 2620	1636	rundll32.exe	29
PID 1636 wrote to memory of 2620	1636	rundll32.exe	29
PID 1636 wrote to memory of 2620	1636	rundll32.exe	29
PID 2620 wrote to memory of 2860	2620	rundll32.exe	31
PID 2620 wrote to memory of 2860	2620	rundll32.exe	31
PID 2620 wrote to memory of 2860	2620	rundll32.exe	31
PID 2620 wrote to memory of 2860	2620	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Tool_1CD_2016v030_edit_mode\icuuc40.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Tool_1CD_2016v030_edit_mode\icuuc40.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 232
    3⤵
    - Program crash
    PID:2860