2769155d033b0441b80165f00a126db615ba18046ae0a952c9d145ee4ce1b0ae

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 07:23

Target

$APPDATA/24/remind/domains/u2l2000.dll
Size

22KB
MD5

6ec4efacbc97780df137830a7048eb84
SHA1

42baf27afbed37494c6dec64397bee989bee346b
SHA256

2dca9c28a3a056bf5a851bc0715da8f794a2c5663c2a55290fe802fb67eebf2a
SHA512

8a4951d17858b043ec279a322d54fa759f58e05237865ca7c7d93a60e253f2d7183d35581934561044a2b23b9aec64bb3bb3f9ec9977224c1621eccf75302475
SSDEEP

384:5w2rZdfNO4Pdc1YUo21/ar7jCDS+/hLCcY9jBJJ1lqI:5w27iSr747pL38TJ1lqI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2924	2884	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2884	2864	rundll32.exe	28
PID 2864 wrote to memory of 2884	2864	rundll32.exe	28
PID 2864 wrote to memory of 2884	2864	rundll32.exe	28
PID 2864 wrote to memory of 2884	2864	rundll32.exe	28
PID 2864 wrote to memory of 2884	2864	rundll32.exe	28
PID 2864 wrote to memory of 2884	2864	rundll32.exe	28
PID 2864 wrote to memory of 2884	2864	rundll32.exe	28
PID 2884 wrote to memory of 2924	2884	rundll32.exe	29
PID 2884 wrote to memory of 2924	2884	rundll32.exe	29
PID 2884 wrote to memory of 2924	2884	rundll32.exe	29
PID 2884 wrote to memory of 2924	2884	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\24\remind\domains\u2l2000.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\24\remind\domains\u2l2000.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 232
    3⤵
    - Program crash
    PID:2924