33b1cc24f787e0879be88253b5c445f9d4f9b0d8d678049dbf78fcdb94b65fe7

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 14:17

Target

Tool_1CD_2016v030_edit_mode/icudt46.dll
Size

14.5MB
MD5

4efaf3bca3e6b86addfd0b719703d782
SHA1

f8b011b4a0d828456f864682d8fe5517cd87ffcc
SHA256

488dd0e76670fa4bac93b29465eac51ecaa0371d3f1f5e2d12323fa5100d3325
SHA512

499685fe377bfd4e2b1cdbf632e4c07c108e93a0b5959458a9fd80c9c4cd696b3a091ab7de0c35294af4f29ea610b5e70e8e9d5bd0f4daaae44fccd9dec7b1ff
SSDEEP

196608:BDIORDhDEDmDwqXCagQZhzvilh2WhiesUjOx:BDXRlDsqXCagQZhzvilh2WlHjO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2212 wrote to memory of 2672	2212	rundll32.exe	27
PID 2212 wrote to memory of 2672	2212	rundll32.exe	27
PID 2212 wrote to memory of 2672	2212	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Tool_1CD_2016v030_edit_mode\icudt46.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2212 -s 84
  2⤵
  PID:2672