4aab20889fea1250ebff86fd28bebdaa19cc310c496bcddcfdf2d3db56387a3c

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
26-02-2024 15:17

Target

resources/binaries/blitz-overlay.dll
Size

1.7MB
MD5

b7456f99600f4c7a2a60ac1b04281a69
SHA1

5bcc2a83dd4cc4474f09a8caadf3e242829933b8
SHA256

6af97585953a5ba4ebed672330d51eba208b94392807ec0a009a227ca1726da2
SHA512

d135caa370cd4fb698e8b0f0afc83ba3fe5b277eeb276fc96f6260ef23f0e357fa1cc7f5518cfb5e3ec0802c5776d2c1775e95902061d30d19244c3712722a3c
SSDEEP

24576:l0LR2Gva1dreNTvIo1MGN/2n3g8PD+Fue2f00I7ZOxFkyPpHALT:GcSvI6MGN/2n3nyFP2M0WezpgLT

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2240 1656 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2240	1656	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2100 wrote to memory of 1656	2100	rundll32.exe	rundll32.exe
PID 2100 wrote to memory of 1656	2100	rundll32.exe	rundll32.exe
PID 2100 wrote to memory of 1656	2100	rundll32.exe	rundll32.exe
PID 2100 wrote to memory of 1656	2100	rundll32.exe	rundll32.exe
PID 2100 wrote to memory of 1656	2100	rundll32.exe	rundll32.exe
PID 2100 wrote to memory of 1656	2100	rundll32.exe	rundll32.exe
PID 2100 wrote to memory of 1656	2100	rundll32.exe	rundll32.exe
PID 1656 wrote to memory of 2240	1656	rundll32.exe	WerFault.exe
PID 1656 wrote to memory of 2240	1656	rundll32.exe	WerFault.exe
PID 1656 wrote to memory of 2240	1656	rundll32.exe	WerFault.exe
PID 1656 wrote to memory of 2240	1656	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\binaries\blitz-overlay.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2100

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\binaries\blitz-overlay.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 220
3⤵
- Program crash
PID:2240