d7dafb1954e6216b222a0a74a7b8f3d9ab12a4101699a93df8cdf8e7dfc348cb

Analysis

max time kernel
1559s
max time network
1559s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
02/03/2024, 14:36

Target
SP/UniteFxControl.dll
Size 1.1MB
Sample240302-ryqqlsee76
SHA256 afe6075ea7dd1bdcbc47b38385216d11cdd5ebc3f82eeedfa6d766e9249d6252
MD5 6ac19cffc0c58ce35ae704c381c4f702
SHA1 c43900c5d56d62311a337b04c9489afc1c75c175
SHA512 61197228b9a1bb9810c68cc04928fd47e2bbe78d36f71c4a2ee498742fea8fd6c950cf43578fa20c6009f1ed6343bf8ca7bfb155512018aac88a4191fad4f939
SSDEEP 24576:XBLW5gqPvbSfiCRcXw0qU6RmWByuAy5a/owH/1:ZqPvbv/Zwm4yi5aQwHN
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2012	1732	rundll32.exe	28
PID 1732 wrote to memory of 2012	1732	rundll32.exe	28
PID 1732 wrote to memory of 2012	1732	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SP\UniteFxControl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1732 -s 164
  2⤵
  PID:2012