4aab20889fea1250ebff86fd28bebdaa19cc310c496bcddcfdf2d3db56387a3c

Analysis

max time kernel
303s
max time network
319s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-02-2024 15:17

Target

resources/binaries/blitz_core.dll
Size

485KB
MD5

8189abce64e95fdfd70e02334298e527
SHA1

db4f1c8a029239c11d428d7bcf430ce9c8efef23
SHA256

1ba42dc32bb40722e22b765b6687dc16e8611a2285be034370ef0f492e713a5b
SHA512

5405a47d93257c18874b751896dbfc4c0f2c9c62908f6474188cc5473e01d185d342a9764bababbeec995848ca9cd37ad8748aaa6c04c640bbf691a3d79189fc
SSDEEP

12288:yHYCHpR0qz4MsF1/Ep4fF3MvwLiK3+5xy6mZqAFKiUG8g:J2T+FBEp2LiKO5xYqAFKiZ3

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2496 2600 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2496	2600	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2692 wrote to memory of 2600	2692	rundll32.exe	rundll32.exe
PID 2692 wrote to memory of 2600	2692	rundll32.exe	rundll32.exe
PID 2692 wrote to memory of 2600	2692	rundll32.exe	rundll32.exe
PID 2692 wrote to memory of 2600	2692	rundll32.exe	rundll32.exe
PID 2692 wrote to memory of 2600	2692	rundll32.exe	rundll32.exe
PID 2692 wrote to memory of 2600	2692	rundll32.exe	rundll32.exe
PID 2692 wrote to memory of 2600	2692	rundll32.exe	rundll32.exe
PID 2600 wrote to memory of 2496	2600	rundll32.exe	WerFault.exe
PID 2600 wrote to memory of 2496	2600	rundll32.exe	WerFault.exe
PID 2600 wrote to memory of 2496	2600	rundll32.exe	WerFault.exe
PID 2600 wrote to memory of 2496	2600	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\binaries\blitz_core.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2692

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\binaries\blitz_core.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 268
3⤵
- Program crash
PID:2496