b1865a08154364f00bc4350a99012043bfca5b14734fb8ab505ade40dd6a0cc2

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-01-2024 03:38

Target

owutility.dll
Size

1.4MB
MD5

0b72a72b76b71076c78773802495d377
SHA1

921101f1342c180677c4bfc7006baf3292a77f9a
SHA256

c127bd152b674d35a7c5a65cc933c385d64622ae2ea09b7194c1de7bdda1c690
SHA512

28afe1b4982e31784393182a06925b6758a19436eba28f89dedc2a380845939d31e947ef676fe8e34f382c7ae28fa88078380df9e83ba9ce7d7c1e9df96a952c
SSDEEP

24576:j9mW+IacegtK/KzWfuBRidv/Eg//aErsVRgf3KvmZJ6NpobhmhGycID8ST:j9mRFIK/KzyuBRidUg/SErsXgfavmu/J

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2208	2216	rundll32.exe	28
PID 2216 wrote to memory of 2208	2216	rundll32.exe	28
PID 2216 wrote to memory of 2208	2216	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\owutility.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2216 -s 140
  2⤵
  PID:2208