b75ff60aaccd7c025a5a2d27afc266bf23808cf46840a4bc868859f0902e09a8

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 15:27

Target

TwistedBrush/Image2PDF.dll
Size

772KB
MD5

15ba076becd1173837ae29a4fcd01d29
SHA1

67962430c4d4850962e2dffad160159a9f2a7776
SHA256

cecabe0f66119aa78da0c3386d084033a4ced3d8d869c1421af28f3b3b1b5d9a
SHA512

541f880c65fb03520d0fd71a156f62b8631520ec68ecac1dc916671a8d33bd6fc030b260187e5c39933a662aba415f0def76b4516529c898a13f607a9e89eb58
SSDEEP

24576:ge1ok43G+BcnksGisV+xRtPw7BrZhAkt:WVWiiG1t

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3056	2100	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2100	2304	rundll32.exe	28
PID 2304 wrote to memory of 2100	2304	rundll32.exe	28
PID 2304 wrote to memory of 2100	2304	rundll32.exe	28
PID 2304 wrote to memory of 2100	2304	rundll32.exe	28
PID 2304 wrote to memory of 2100	2304	rundll32.exe	28
PID 2304 wrote to memory of 2100	2304	rundll32.exe	28
PID 2304 wrote to memory of 2100	2304	rundll32.exe	28
PID 2100 wrote to memory of 3056	2100	rundll32.exe	29
PID 2100 wrote to memory of 3056	2100	rundll32.exe	29
PID 2100 wrote to memory of 3056	2100	rundll32.exe	29
PID 2100 wrote to memory of 3056	2100	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TwistedBrush\Image2PDF.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\TwistedBrush\Image2PDF.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 224
    3⤵
    - Program crash
    PID:3056