36f4a643b55ba7dcba92c8a8e1ef5f05bf2acc1d866ea1d8752a926f848cca44

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 20:03

Target

bugfire/woNoWepChangeandwoInstaDefuse.dll
Size

303KB
MD5

8e36e27b1d47af73b53582c7b651c6e2
SHA1

746020b6e7eab317fb3de5731ac378bb3c0a2607
SHA256

0b2095fb6c0440e7f196ace4094739bff6a82c8941c70d3677541911bee0c3b4
SHA512

27295f35b95c47f2c98a23f6ddf80418edfe0c790a830aa345762d67f435b4c16fadbd8da0062d749d42635fc8ab42b0786e4325971497bf79109fdc8116e355
SSDEEP

6144:KuqctITXxcZcyGUtvNJNI9iiY/h2c888888888888W88888888888:5OQcyRXCdY/hf888888888888W88888P

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 368	2708	rundll32.exe	18
PID 2708 wrote to memory of 368	2708	rundll32.exe	18
PID 2708 wrote to memory of 368	2708	rundll32.exe	18
PID 2708 wrote to memory of 368	2708	rundll32.exe	18
PID 2708 wrote to memory of 368	2708	rundll32.exe	18
PID 2708 wrote to memory of 368	2708	rundll32.exe	18
PID 2708 wrote to memory of 368	2708	rundll32.exe	18

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bugfire\woNoWepChangeandwoInstaDefuse.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bugfire\woNoWepChangeandwoInstaDefuse.dll,#1
  2⤵
  PID:368

memory/368-0-0x0000000000210000-0x0000000000266000-memory.dmp

Filesize
344KB

Download
memory/368-1-0x0000000000210000-0x0000000000266000-memory.dmp

Filesize
344KB

Download