f34796ba5f124f1eb4b610756a43e8bfc789cf6d78a31c91bdcc132a3d4ecdb8

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 19:07

Target
credit card gen/GUI.dll
Size 1.8MB
Sample240315-xstszaae89
SHA256 8dbdf6007649298cc96737fbca03eab72042432bb231b88dd92db96e42f92e04
MD5 f83ef73f6fc8e292535366c53c8d9f11
SHA1 0244e78c0b2a6fd2542a442a204d2085dfb5ff46
SHA512 f0cc82fff4adb6e23ad9ff3d221db1e726223abfc38595548a744871435a95274ce166b25ddcf0ce5ce0897b3880b46d70da08ccc69a05e7a867e11b905220d2
SSDEEP 24576:BuLb4h5hg7IMbuJXEUI2jFo+RNuUP2aHtXKA/pSg5XXNnxkFKDA:Bs+g7IlNEUVRgUP2aHtXKA/pSWnx9
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1472	2044	rundll32.exe	28
PID 2044 wrote to memory of 1472	2044	rundll32.exe	28
PID 2044 wrote to memory of 1472	2044	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\credit card gen\GUI.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2044 -s 172
  2⤵
  PID:1472