6bd6cd1c6bcfe0790fc8f5d50afa96c0b0d300c823952d98c68154e178bc5083

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/01/2024, 18:44

Target
x64/tradingnetworkingsockets.dll
Size 4.1MB
Sample240122-xdf9bschc2
SHA256 fc4a65ff603bf1f4bfe323de1866145ae1e006aa656799fd134dfa63d92d47c1
MD5 3cf26ce759c5e261fe3ecc6451b8b08e
SHA1 b5da110034fe394a4020367404534903764473fe
SHA512 e7b543483f38bb6338490b5c8f5da6f95e0d78b45f2b26d898cc3b58cf7c359952bfe413414cb6cd1532c3c6fd7a860026b2bec7b6d0ddfbee9a1385a62e14f2
SSDEEP 49152:kGtlqhcIU6ilVwASObX9F+LWDumqrJjAZVT4kmrqEUAYVxkG3q+XRQsmqkALD4z4:M+dl7+8z1mqkA8lv0bH1bBGZZs
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 304	2476	rundll32.exe	28
PID 2476 wrote to memory of 304	2476	rundll32.exe	28
PID 2476 wrote to memory of 304	2476	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x64\tradingnetworkingsockets.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2476 -s 148
  2⤵
  PID:304