e8582220f161aef10bcba30369f4d9a3f2a53024b9cd4a5f9f9fecfb98ba8be2

Analysis

max time kernel
121s
max time network
157s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 20:47

Target

WindowBlinds/smart.dll
Size

36KB
MD5

c904da5b9b2c5a3109a19c3253036857
SHA1

660a1072b3b7223f2dc39e8a76511ce0da7b89b3
SHA256

34a10a06eec4617bc2e8ce45b9798e93444f40aaca2d784a39764a7084537c21
SHA512

96ebd1973f0c4cfc0943a2539abd8bf692a5585de984ef61c20b2a8bb19fba28c994f79051acb33c7d99ea42fd0a7c32b0811dc088a8a4c060626f5d0c611089
SSDEEP

384:/tQtSH1WJETUqTha67WM8qLBc4cml8YnyDcdN6OM5KSKez0o:1Q64qT86yMxLSynH6R1Kez

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2280	2424	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2424	3036	rundll32.exe	28
PID 3036 wrote to memory of 2424	3036	rundll32.exe	28
PID 3036 wrote to memory of 2424	3036	rundll32.exe	28
PID 3036 wrote to memory of 2424	3036	rundll32.exe	28
PID 3036 wrote to memory of 2424	3036	rundll32.exe	28
PID 3036 wrote to memory of 2424	3036	rundll32.exe	28
PID 3036 wrote to memory of 2424	3036	rundll32.exe	28
PID 2424 wrote to memory of 2280	2424	rundll32.exe	29
PID 2424 wrote to memory of 2280	2424	rundll32.exe	29
PID 2424 wrote to memory of 2280	2424	rundll32.exe	29
PID 2424 wrote to memory of 2280	2424	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WindowBlinds\smart.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WindowBlinds\smart.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 228
    3⤵
    - Program crash
    PID:2280