d847b98ee4ccdadf0a406fa42cac1de6132ed595bc3986c54e22a1b46e178aaa

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23/04/2024, 10:45

Target

owutility.dll
Size

1.5MB
MD5

9b23fbe15c5ebb0d09b901e1e139f97d
SHA1

730807444686f38dc92b1c47ccf1f524f3277f60
SHA256

99f69191760484ee8aacc5c453f1b14b8c977da312e91dd34cdc6b254872ed43
SHA512

30dde82199d53c7cace90faa4f6e2e4725a21f881b99d27f347ddaae75b5e1af5a351c0ac2adca535489dfc59de7cfd379cf71270dfc6f975e167996e840262e
SSDEEP

24576:cCRhljMyiAfrZF++n6iJLDMj3M8s2MmSVbnMAugm1UplhBwPTPxyvew:cCHlj5ZrZFnn6iJ8j88sUSVbHuLShq/w

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 1656	2192	rundll32.exe	28
PID 2192 wrote to memory of 1656	2192	rundll32.exe	28
PID 2192 wrote to memory of 1656	2192	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\owutility.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2192 -s 148
  2⤵
  PID:1656