e7cf02ad880e8ebb37134c5370189bd2620ce1bf60794aa8776db6ccc4d4f0f7

Resubmissions

18/11/2024, 05:08

20/05/2024, 06:56

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 06:56

Target
125/Addons/bin/deploy.dll
Size 442KB
Sample240520-hqdlmsgf63
SHA256 87847204933551f69f1cba7a73b63a252d12ef106c22ed9c561ef188dffcbae8
MD5 5edaeffc60b5f1147068e4a296f6d7fb
SHA1 7d36698c62386449a5fa2607886f4adf7fb3deef
SHA512 a691ef121d3ac17569e27bb6de4688d3506895b1a1a8740e1f16e80eefce70ba18b9c1efd6fd6794fafc59ba2caf137b4007fcdc65ddb8bcbfcf42c97b13535b
SSDEEP 6144:3J/sbugq7rm5zX2JDYfiA9+wvpsEWcIGnFm8iTFOBITfnvxIW1x8:3JUbzq+5zX25qvdfnFm88nvq+x8
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2208	2200	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2200	1724	rundll32.exe	28
PID 1724 wrote to memory of 2200	1724	rundll32.exe	28
PID 1724 wrote to memory of 2200	1724	rundll32.exe	28
PID 1724 wrote to memory of 2200	1724	rundll32.exe	28
PID 1724 wrote to memory of 2200	1724	rundll32.exe	28
PID 1724 wrote to memory of 2200	1724	rundll32.exe	28
PID 1724 wrote to memory of 2200	1724	rundll32.exe	28
PID 2200 wrote to memory of 2208	2200	rundll32.exe	29
PID 2200 wrote to memory of 2208	2200	rundll32.exe	29
PID 2200 wrote to memory of 2208	2200	rundll32.exe	29
PID 2200 wrote to memory of 2208	2200	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\125\Addons\bin\deploy.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\125\Addons\bin\deploy.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 232
    3⤵
    - Program crash
    PID:2208