0d8ea62f062e14bdded875879212a3162fd0c08737ba38332fdce0ef1eebcd83

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
08/04/2024, 23:29

Target

R3Air.2.0.0.Release.64/Adobe AIR/Versions/1.0/Resources/WebKit.dll
Size

7.3MB
MD5

4ed09ae7d12cafd09eae4eccc1c9e510
SHA1

b4b8f31aae9fcc09785256d5fd8faf57c515588f
SHA256

66c3b89b33c43dfb1c0ec6fb7085c2442c98c27683a943f3115fb77c9d45e705
SHA512

0f1fbb5046b070191e7549eefa27a5567bef823decdfb0f1db8adb6e69d9b0799dae7ba87577b59efaca4b12c7bf5969a0f39aa15b12b7829d56858c81ae10f5
SSDEEP

98304:fcvFc2Vi+zLlApdmBtY48y+9+c6h8F61y/xwYp86uyPJdLyq:foC2VtzLqdmBtY48ys+c6h8F61U1WA

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 2036	1256	rundll32.exe	28
PID 1256 wrote to memory of 2036	1256	rundll32.exe	28
PID 1256 wrote to memory of 2036	1256	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\R3Air.2.0.0.Release.64\Adobe AIR\Versions\1.0\Resources\WebKit.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1256 -s 148
  2⤵
  PID:2036