33b1cc24f787e0879be88253b5c445f9d4f9b0d8d678049dbf78fcdb94b65fe7

Analysis

max time kernel
117s
max time network
141s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 14:17

Target

Tool_1CD_2016v030_edit_mode/icudt34.dll
Size

8.5MB
MD5

bce1653cb7bcdce3861e4438ae8dcee4
SHA1

12f963bce051a1c9cd33b9f311118034b54c129f
SHA256

5b75657306cdccda0d7181721515f27e26c29e7270992fe0f7f169ddc7472aee
SHA512

d786a482771b400d329e54d980b78b8e5703adba6b19c7e618ef7385f3924137516a523b5ec9630e8e70b5f384e83d1c1058d379c49446f44d9a716c00a9e6d9
SSDEEP

98304:Gk2Ph055PfECL8BHeTLIOsRStl2Cp/c8DSqpKZVxfNqn80iPChzIB:GkgcdfrMeTLIOsuKzqnxe

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2488 wrote to memory of 1256	2488	rundll32.exe	28
PID 2488 wrote to memory of 1256	2488	rundll32.exe	28
PID 2488 wrote to memory of 1256	2488	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Tool_1CD_2016v030_edit_mode\icudt34.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2488 -s 84
  2⤵
  PID:1256