d3e26c7296830666e8d5758afc850c5b596ceb3e2c1ebbb01d5dc22ff58ff5fa

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 18:47

Target
DreamMail4/Sys/IPSearcher.dll
Size 20KB
Sample240228-xfbfvsbc98
SHA256 b208167da7a5fe33ba7dfe19276b17cc580628e7c600b2038b23840b6cb89601
MD5 75d6153ab91677d01c3d1531d0dc20c6
SHA1 9312f97524fd8336693f5689816faca6af24b83e
SHA512 1a93518df4cc8ea99da063ed3dd7ebc1a8e6e65cdb290eef453d3cde7011f543ad43818ac0c00b7b6433998807a29c807cd1b5000aee51cdd92c9fee1957ae56
SSDEEP 384:EpP1lqK7WW5sFwFBKwR9qGMUJaV/xx9rcq232RbC8fQ:EbgiWW5nKwGzU4j9rcmRbtf
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2316	2908	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2908	2868	rundll32.exe	28
PID 2868 wrote to memory of 2908	2868	rundll32.exe	28
PID 2868 wrote to memory of 2908	2868	rundll32.exe	28
PID 2868 wrote to memory of 2908	2868	rundll32.exe	28
PID 2868 wrote to memory of 2908	2868	rundll32.exe	28
PID 2868 wrote to memory of 2908	2868	rundll32.exe	28
PID 2868 wrote to memory of 2908	2868	rundll32.exe	28
PID 2908 wrote to memory of 2316	2908	rundll32.exe	29
PID 2908 wrote to memory of 2316	2908	rundll32.exe	29
PID 2908 wrote to memory of 2316	2908	rundll32.exe	29
PID 2908 wrote to memory of 2316	2908	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DreamMail4\Sys\IPSearcher.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DreamMail4\Sys\IPSearcher.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 224
    3⤵
    - Program crash
    PID:2316

memory/2908-0-0x0000000010000000-0x000000001000F000-memory.dmp

Download

memory/2908-1-0x0000000010000000-0x000000001000F000-memory.dmp

Download

memory/2908-2-0x0000000000180000-0x0000000000181000-memory.dmp

Download

memory/2908-3-0x0000000000180000-0x0000000000181000-memory.dmp

Download