e8784b21f05c7f91ae6082ae912ddefddf62bccf717c2a9f649f147eb28eadbb

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 18:15

Target

owutility.dll
Size

1.5MB
MD5

651be77b72f07779b26f2e2df4c95324
SHA1

3285a850ff632659cebfd3be8e3e65730b483b1d
SHA256

9ce3065cdc8b581a4dc33ebc98f6ea98933e75b87e262834c21c46dfb3bd5048
SHA512

020ca2db9147df510013beb6fb0ab1b8cf491e5505d2040c35f66c29b8858dd787361dd092a2b13c817eebae57690a9020f5da310452a4c21762826d2fe758a9
SSDEEP

24576:mjjAyN7CbTB3Iu2VIMiFryCF9fLp34G5cdHSdslQ3m3oGch+XaxLaXp/:mjcyNeR3IuUIMiFLFpLp3z5cdgsvYFhU

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2972	2548	rundll32.exe	28
PID 2548 wrote to memory of 2972	2548	rundll32.exe	28
PID 2548 wrote to memory of 2972	2548	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\owutility.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2548 -s 148
  2⤵
  PID:2972