4c51547745fd5b7c107e5b89cbd6be9ea4d43195fb4a1011987c8a33b7158251

Analysis

max time kernel
70s
max time network
95s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/03/2024, 02:50

Reason

Machine shutdown

Target
Main/Converter/V0/Interop.DSOFramer.dll
Size 22KB
Sample240302-db1qeahe48
SHA256 7503588072587fe1346fb40026124e230b122ddf2666e4046815fee37010b0d1
MD5 34ba3325cebfb8a49fcbe3ca36435133
SHA1 98fa9dca395bba129f9774c82a7a2e5154841a8d
SHA512 50b8b585d59725fd579e34c24c90354e7a2e0bb4d565d2d7f6f614279f9746514baff6435b3299b0e36c7ffbbc41508f26d68396a1d918eb23086644464a46af
SSDEEP 384:+KZKzkteHYgcfvlBKlP79le5cXkYngHKeUZw1hjCO/Jns8:9KzkteHYgcfN479lh0Yng1MXO/T
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2600	2740	rundll32.exe	28
PID 2740 wrote to memory of 2600	2740	rundll32.exe	28
PID 2740 wrote to memory of 2600	2740	rundll32.exe	28
PID 2740 wrote to memory of 2600	2740	rundll32.exe	28
PID 2740 wrote to memory of 2600	2740	rundll32.exe	28
PID 2740 wrote to memory of 2600	2740	rundll32.exe	28
PID 2740 wrote to memory of 2600	2740	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Main\Converter\V0\Interop.DSOFramer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Main\Converter\V0\Interop.DSOFramer.dll,#1
  2⤵
  PID:2600

SendEnable.jtx

Path C:\Users\Admin\Desktop\SendEnable.jtx
Size 645KB
SHA256 b113d6a8f7b5d8739ea22e01bdb2577071fb33b9c029104b1727dc9614efdd82
MD5 39a81720dbaa4c529070db1e9fa33839
SHA1 a29a5d40bb791e29be47666db98fcce72a4a0a63
SHA512 ee0d1bebc9daab082f9ac4f124ce4735769974b70edf58a0dff22a0fdb1a5dcace41a911d2c7ff63b02f770f0dfd7719550d382ba1fd931eb2c05890dd795e79
SSDEEP 12288:Ov4+zDDQHdWerANZwkLgF3QaV53srBzj2aaCi+c:OnD+dgLm3QK5crBz6
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1640-2-0x00000000026E0000-0x00000000026E1000-memory.dmp

Download

memory/2808-1-0x00000000029C0000-0x00000000029C1000-memory.dmp

Download