2bcc5dfa32e627a0913c1a00e3c5cae1fc428c276d51c3abc26a4644d3c3a0fb

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 16:49

Target

$TEMP/RealCompat/gcapi.dll
Size

62KB
MD5

a689eb4192ac28683b18c4e81b32559a
SHA1

aa436608c0e1a1a21153346a046ff00ee60aff1d
SHA256

cb81506dcb4de19a8c300ee010061845a7f20448c2387ae845f2d2099b54c981
SHA512

992c8f6e441e096c5def826c5665469b89642b0fc9a381f2cf63a98eb08bd58e4186a3a615078cd2775b78240f519c27501f46dea40e9b8b82b6d91b95d5ed17
SSDEEP

768:sqn6Uu9UJwki/IKbRBxPRZpEzalO2RBgITg1g0sqpkkaTL16QP3u8Gf:serwkobRLOuOA/TgW01na/oQ/zO

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2116 2040 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2116	2040	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1684 wrote to memory of 2040	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 2040	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 2040	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 2040	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 2040	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 2040	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 2040	1684	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 2116	2040	rundll32.exe	WerFault.exe
PID 2040 wrote to memory of 2116	2040	rundll32.exe	WerFault.exe
PID 2040 wrote to memory of 2116	2040	rundll32.exe	WerFault.exe
PID 2040 wrote to memory of 2116	2040	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\RealCompat\gcapi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\RealCompat\gcapi.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 220
3⤵
- Program crash
PID:2116