b5dc1c1a5d7112d19f225d14b0ba7e704994d619e6b2767be341cbeca885d933

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/02/2024, 23:17

Target

libfilezilla-42.dll
Size

891KB
MD5

34a1e09147a3b5be04bdd3d549edd11b
SHA1

f47cdbfa3719cc7897c472c8ba0a3591c63bb110
SHA256

5a48633810356d16d96004f343df8b5ae361f2a170de9bf92cb94578e034533c
SHA512

7800c94907aeec900175e8d37f5bf7f373c0c59f80c8982b843ffdae2c2cb6549aea2c271296a3bedafa08cf03fe1753659acb3244c57b48b959e24ef242a5a7
SSDEEP

12288:yZ7Zr8KF3ksG0sn8d7cNV9MNCemcx1+C1PS0ZDu4POjjjSDtQjC4n/:y9ZrBvSn8VvNCeEz0Z3Pq/SDtQjC4/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2816	2156	rundll32.exe	28
PID 2156 wrote to memory of 2816	2156	rundll32.exe	28
PID 2156 wrote to memory of 2816	2156	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libfilezilla-42.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2156 -s 124
  2⤵
  PID:2816

memory/2156-0-0x000007FEF6C90000-0x000007FEF6D73000-memory.dmp

Filesize
908KB

Download
memory/2156-1-0x000007FEF7990000-0x000007FEF7A34000-memory.dmp

Filesize
656KB

Download
memory/2156-2-0x000007FEF66F0000-0x000007FEF68FB000-memory.dmp

Filesize
2.0MB

Download
memory/2156-3-0x000007FEF86E0000-0x000007FEF8729000-memory.dmp

Filesize
292KB

Download
memory/2156-4-0x000007FEF7930000-0x000007FEF7985000-memory.dmp

Filesize
340KB

Download
memory/2156-5-0x0000000075480000-0x00000000754A9000-memory.dmp

Filesize
164KB

Download
memory/2156-6-0x000007FEFAEF0000-0x000007FEFAF11000-memory.dmp

Filesize
132KB

Download
memory/2156-7-0x000007FEF6500000-0x000007FEF66E7000-memory.dmp

Filesize
1.9MB

Download