880ab4ff495259f9f9ed395da29c009494c8243a987b55c6f08ed3bca6a76849

Resubmissions

27/11/2023, 19:16

27/11/2023, 18:50

max time kernel
140s
max time network
127s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
27/11/2023, 19:16

Target

install.dll
Size

1.5MB
MD5

8e782bcea1295ce27ecb555bab55ead7
SHA1

ce8cb59fd86ca4c1f1205a2f337a3c351a13df92
SHA256

880ab4ff495259f9f9ed395da29c009494c8243a987b55c6f08ed3bca6a76849
SHA512

9817edd72251cb2100372cab56e9fce3246769c3205a2bd915b8dc1dcc1401f6310d0d751c932f7f16719a462fbbd2e01d2fb48fdb1283746d436218b4d30621
SSDEEP

24576:zkK/6yt+SwCNLOFshu5of+8uvtzfTlPvW+hPoufdsOgkFPJlQn2Aihal:zkWCSVAFshuQ+8uvtrTlPvWMoufdsFks

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2932	1752	rundll32.exe	28
PID 1752 wrote to memory of 2932	1752	rundll32.exe	28
PID 1752 wrote to memory of 2932	1752	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\install.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1752 -s 84
  2⤵
  PID:2932

memory/1752-0-0x000007FEF68F0000-0x000007FEF6A73000-memory.dmp

Filesize
1.5MB

Download