0db9ac02645846b5033b403a818544371046214bfedef7e70d44f5f825713c00

Analysis

max time kernel
120s
max time network
138s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 08:59

Target

rime.dll
Size

3.2MB
MD5

e5aa6a289227c7055da352a77aa4ed94
SHA1

d8aa240d2fdc626bdbfc506243ce96266a16a253
SHA256

165b4a00f400d3ad425564f1c482f9f34d3b39a25178e9199233c012fb5011a8
SHA512

2f846fe900acd7da0665f7e7dc7eff7cb3e0da23e878ce1d1af7d8156ce1f09238582cded48022a9533246c95f61f330ebfe554cffd717fdab81e7db56c1a294
SSDEEP

49152:fxLfGvcHjhpPmEiVkr1M0DeFLyk53nCFb96oSdRH/yCcN8sfs3J1rU4ooAiTAREt:h/VWHLyk53CFbXSTfGat07ATARes

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2076	3056	rundll32.exe	27
PID 3056 wrote to memory of 2076	3056	rundll32.exe	27
PID 3056 wrote to memory of 2076	3056	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\rime.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3056 -s 100
  2⤵
  PID:2076