65b8710598416e9045603ea83259a5536d8bf431689c2955c6986ac2ced62381

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 18:38

Target

DLL/libhunspell.dll
Size

578KB
MD5

ac2478223d79e405fc1154e19c61f68f
SHA1

9f899dac2b2501aee4e03381eeca7df34a3b4c47
SHA256

4fdb1537458441ecfe4a323647091631a1c5cce92bba8bd51619637951f7cb31
SHA512

6938006994ed0bf210a2143907d741400cb4d1b8afcae101be1d45b5b5e37520fdfdd930a0ef5cbcf3b81f67e107974e294c4232821730f32ca9eaffd0856f56
SSDEEP

12288:q7O74ZjEMD44/ntRieNYRDGf12jntfUrf/JFAPsByypqSFe1co+:aO74jEMDRYRDG8p0JF3ByKqS4co+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2884	2660	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2660	2340	rundll32.exe	28
PID 2340 wrote to memory of 2660	2340	rundll32.exe	28
PID 2340 wrote to memory of 2660	2340	rundll32.exe	28
PID 2340 wrote to memory of 2660	2340	rundll32.exe	28
PID 2340 wrote to memory of 2660	2340	rundll32.exe	28
PID 2340 wrote to memory of 2660	2340	rundll32.exe	28
PID 2340 wrote to memory of 2660	2340	rundll32.exe	28
PID 2660 wrote to memory of 2884	2660	rundll32.exe	29
PID 2660 wrote to memory of 2884	2660	rundll32.exe	29
PID 2660 wrote to memory of 2884	2660	rundll32.exe	29
PID 2660 wrote to memory of 2884	2660	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DLL\libhunspell.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DLL\libhunspell.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 220
    3⤵
    - Program crash
    PID:2884