b3257229561e0cf13e5b13f8171b21d4667898e12e99608c11437a9cd16d7128

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
18/05/2024, 02:42

Target
unrar64.dll
Size 254KB
Sample240518-c7b69age69
SHA256 bcf23a9441d6199cc13ef8bffea24f9d35f2d332fe90139a2297bcf174eba8e3
MD5 9eb37a35736b46369372a9cea8659333
SHA1 8d375593f171b88d27728322736d3c38acff6ac0
SHA512 88dd6bc1ce01c7ec5ae925083fff3e797eed9dc7b3f7f94f1202cbc7709de69ade5c7df82186228a9b44a670e6acb702eeb4b18402e7b9322d395cf59cd6b336
SSDEEP 6144:7dt+5JMTZJPnefq1bmm06DpA/2nODu0xgCgdnd:7dt4+VFyq19dk2ODKd
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 352	2212	rundll32.exe	28
PID 2212 wrote to memory of 352	2212	rundll32.exe	28
PID 2212 wrote to memory of 352	2212	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\unrar64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2212 -s 156
  2⤵
  PID:352