074e3ffd30b58cb5a3bf92776fe89ddf82a5e48cf1aa6bbf43a9790b3df1b5a3

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
18/02/2024, 16:23

Target

Bin/aws-cpp-sdk-access-management.dll
Size

193KB
MD5

03b95b873e08948d871515cba612e32f
SHA1

6ce734d476c37990feb60fc9381c8588d2940fd8
SHA256

294cb03ab3eec05df76e4003c8f0d94878b1e71462137ec50714c1f5c27c4183
SHA512

303de62c2f80da2c41833c1e2ddbd6949ff0c1bd713ec033ea4860f6416a7d943674cbbaeec0f75aced10f8ecacd31e4f8ffa12c8b4f5a442e010f8f63087f37
SSDEEP

1536:D+OTbJltR2AJcRVxQ9Zbfxc5BDV6S+qlfBe/G1NOozqJosSoZOFEAIMZFKj+UkmQ:l1L8xUcnL1NODJeomKjnhJKOADLb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 3060	2340	rundll32.exe	28
PID 2340 wrote to memory of 3060	2340	rundll32.exe	28
PID 2340 wrote to memory of 3060	2340	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Bin\aws-cpp-sdk-access-management.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2340 -s 136
  2⤵
  PID:3060