014984b4b81ac3aee22523fc6a79030159f63a0f79ba6028dde7dd8795b1c325

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-03-2024 06:39

Target

KiwiX(vira)/Exec.dll
Size

6.9MB
MD5

1ed364cd6081f058fd52545e65f31fcd
SHA1

d3cb3660b497d0a6c2e75bd7e679fee3641272fe
SHA256

43830608991e3480dbd8cea33f7a968a388497df1bf2fe61d00ad60627231cbf
SHA512

6f79120e4976dc9a659008535a86f691c511eac9da8919617591a3ae595ba25879f9e3ba455ea8cbfe479d35bb7405264ebdfd599aeb518d9f4861fe4d69bdbd
SSDEEP

98304:du+mrLHJQOsgrMWnbLe9u/t8MmWOv/enGJGp8bHSpC24Gqdi:AdrLHJQhgrMWbq9VMmWGmnQGpvpZ43i

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 2752	1660	rundll32.exe	28
PID 1660 wrote to memory of 2752	1660	rundll32.exe	28
PID 1660 wrote to memory of 2752	1660	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\KiwiX(vira)\Exec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1660 -s 96
  2⤵
  PID:2752