6648d2cb0d90fd5a0be848bf4d189971d9b82f5ca64d6e97377bb8a9b744cf51

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 10:02

Target

texgenpack.dll
Size

27KB
MD5

b57788ae2900716358b84022211b980c
SHA1

5e4e482b1e406f402918de7feb6912ec894ae396
SHA256

ef70c68aa29dfbe524ddeaa42e0454ac016dfa3f37f8fd7e0afbb6e3d0ba6883
SHA512

efe618e8ef62216148682d9fca7097730bbcfadca3ff74ad86b4932358398e6a944cf3ae6167e5c14b2508921cd0bf16003b80f678385945729219f6fddd8bcf
SSDEEP

384:JtFmY+aGq2kUi8GIXYIECiH5o/mAKAqAmRtpLOIkZjWLbSYFKZJFPTQJA2ERnlH:5mu2kU4IX5EpLRttOziFKGWm

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2780	2676	rundll32.exe	28
PID 2676 wrote to memory of 2780	2676	rundll32.exe	28
PID 2676 wrote to memory of 2780	2676	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\texgenpack.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2676 -s 84
  2⤵
  PID:2780