4aab20889fea1250ebff86fd28bebdaa19cc310c496bcddcfdf2d3db56387a3c

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
26/02/2024, 15:17

Target
resources/binaries/blitz-overlay.dll
Size 1.7MB
Sample240226-sn7rtahc33
SHA256 6af97585953a5ba4ebed672330d51eba208b94392807ec0a009a227ca1726da2
MD5 b7456f99600f4c7a2a60ac1b04281a69
SHA1 5bcc2a83dd4cc4474f09a8caadf3e242829933b8
SHA512 d135caa370cd4fb698e8b0f0afc83ba3fe5b277eeb276fc96f6260ef23f0e357fa1cc7f5518cfb5e3ec0802c5776d2c1775e95902061d30d19244c3712722a3c
SSDEEP 24576:l0LR2Gva1dreNTvIo1MGN/2n3g8PD+Fue2f00I7ZOxFkyPpHALT:GcSvI6MGN/2n3nyFP2M0WezpgLT
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2240	1656	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 1656	2100	rundll32.exe	28
PID 2100 wrote to memory of 1656	2100	rundll32.exe	28
PID 2100 wrote to memory of 1656	2100	rundll32.exe	28
PID 2100 wrote to memory of 1656	2100	rundll32.exe	28
PID 2100 wrote to memory of 1656	2100	rundll32.exe	28
PID 2100 wrote to memory of 1656	2100	rundll32.exe	28
PID 2100 wrote to memory of 1656	2100	rundll32.exe	28
PID 1656 wrote to memory of 2240	1656	rundll32.exe	29
PID 1656 wrote to memory of 2240	1656	rundll32.exe	29
PID 1656 wrote to memory of 2240	1656	rundll32.exe	29
PID 1656 wrote to memory of 2240	1656	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\binaries\blitz-overlay.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\binaries\blitz-overlay.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 220
    3⤵
    - Program crash
    PID:2240