f06b9edda0a7249ee633ff2b469853623e307b981ec43e53ed28bde6704bcee7

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 06:27

Target

nmap-7.60/libssh2.dll
Size

148KB
MD5

8420802e447c9d49b69ee3a344284609
SHA1

a0b10a12efb955b4214aca595f4cb803099a3eb5
SHA256

63fde79687ffb9e602c2862eaa97747b8d17305b4fee9483ec19f0f7ef671211
SHA512

27213d36a366f3cc93a5d2bdef71b42d7d4d290aff88763dcb0837ba6c1a11ce4abc9df39927e0a57cd39a5f54d962e5171990a91f7c6a4ecb0dd8c3848fd6fd
SSDEEP

3072:wwVNzokQtBJEYEHIwaNJbZwwOyDXb0+er4e1dHqZuRGltH:wwVNzozmYEHI3VbXb07rv1dHqZuYH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2224	1516	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 1516	2904	rundll32.exe	28
PID 2904 wrote to memory of 1516	2904	rundll32.exe	28
PID 2904 wrote to memory of 1516	2904	rundll32.exe	28
PID 2904 wrote to memory of 1516	2904	rundll32.exe	28
PID 2904 wrote to memory of 1516	2904	rundll32.exe	28
PID 2904 wrote to memory of 1516	2904	rundll32.exe	28
PID 2904 wrote to memory of 1516	2904	rundll32.exe	28
PID 1516 wrote to memory of 2224	1516	rundll32.exe	29
PID 1516 wrote to memory of 2224	1516	rundll32.exe	29
PID 1516 wrote to memory of 2224	1516	rundll32.exe	29
PID 1516 wrote to memory of 2224	1516	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\nmap-7.60\libssh2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\nmap-7.60\libssh2.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 224
    3⤵
    - Program crash
    PID:2224