b5dc1c1a5d7112d19f225d14b0ba7e704994d619e6b2767be341cbeca885d933

Analysis

max time kernel
140s
max time network
125s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
22/02/2024, 23:17

Target

libfzclient-commonui-private-3-66-5.dll
Size

611KB
MD5

5e0dc1ec221d3a564be50e9e416bf43d
SHA1

2b808c44c80b9ae6b9e4bf8cb27df0b8191577af
SHA256

44b1d3616ad095d7d9ca23b3cc77e76c372ce65e5f568fe619990d34ccaaaead
SHA512

34edc6cc998cd2f92278e5bfaceb73690fe3f01323ea136f2ecc8b157e8fc1dd252073682f8f225a8eabd6ae08c2314e8d454d183359fdef7cdae55ec78299bb
SSDEEP

6144:rc1+MmxFlHVvQdpwaWJ8eho2e3zrJ2gLo4MVnmmaPyq8ub0LqDnK737xnE+/zMAe:umxFl1vQpSgJgjVmPPygUoK737++/z0x

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 1320	2964	rundll32.exe	28
PID 2964 wrote to memory of 1320	2964	rundll32.exe	28
PID 2964 wrote to memory of 1320	2964	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libfzclient-commonui-private-3-66-5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2964 -s 192
  2⤵
  PID:1320

memory/2964-0-0x000007FEF6FC0000-0x000007FEF705E000-memory.dmp

Filesize
632KB

Download
memory/2964-1-0x000007FEF5E60000-0x000007FEF5FBD000-memory.dmp

Filesize
1.4MB

Download
memory/2964-2-0x000007FEF6350000-0x000007FEF6433000-memory.dmp

Filesize
908KB

Download
memory/2964-3-0x000007FEF5DB0000-0x000007FEF5E54000-memory.dmp

Filesize
656KB

Download
memory/2964-4-0x000007FEF5BA0000-0x000007FEF5DAB000-memory.dmp

Filesize
2.0MB

Download
memory/2964-5-0x000007FEF7DA0000-0x000007FEF7DE9000-memory.dmp

Filesize
292KB

Download
memory/2964-6-0x000007FEF70A0000-0x000007FEF70F5000-memory.dmp

Filesize
340KB

Download
memory/2964-7-0x0000000074B40000-0x0000000074B69000-memory.dmp

Filesize
164KB

Download
memory/2964-9-0x000007FEF59B0000-0x000007FEF5B97000-memory.dmp

Filesize
1.9MB

Download
memory/2964-8-0x000007FEFA5B0000-0x000007FEFA5D1000-memory.dmp

Filesize
132KB

Download