d9e3c8350875e4f0e74d207351f5db02cfb0e5edd0b62743c38343e38e981727

Analysis

max time kernel
142s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08-02-2024 14:33

Target

Curledness/Hovedplanerne/Syndactyl/Engross/vtablog.dll
Size

268KB
MD5

35119e61479373ba5d7433f106556e79
SHA1

096a7d227eb2514d76ec5d10bfd1cf165d4a9177
SHA256

f21d9de02c67e51bb9f7163f676f2d4710b2befae04fd0751a63cf1278c48a3c
SHA512

21318d0924393c8269419df5acc0c07ca2f754fd9d9ad80d393cf7ebec1b16986d123f2775ae210383b7faa106ed84e829c949004a123da844c07f2b46387453
SSDEEP

3072:s1vaCg+eY9yp71driAAYBnk/+eeaQyJen3n83fucakiD88iryUBw:ovDgZYq/rzfNufuceD5UBw

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2052 wrote to memory of 2492	2052	rundll32.exe	WerFault.exe
PID 2052 wrote to memory of 2492	2052	rundll32.exe	WerFault.exe
PID 2052 wrote to memory of 2492	2052	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Curledness\Hovedplanerne\Syndactyl\Engross\vtablog.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2052

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2052 -s 84
2⤵
PID:2492

memory/2052-0-0x000007FEF71D0000-0x000007FEF7218000-memory.dmp

Filesize
288KB

Download