9d0eef3560fd3b6f9207a21206c4f4337b07bff2cf082869c87bdc1ddd6d2e89

Analysis

max time kernel
1565s
max time network
1566s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 14:49

Target

Osu/optimization_guide_internal.dll
Size

8.2MB
MD5

9e50f4a2f8d4785401009acd9e44cc50
SHA1

91351d9519920388fcbd5854fc4abf86757547d4
SHA256

545de3597fef20c3ac15e728a4fa687f90978d756311f248421f43018c44e900
SHA512

03f5dbea2a96f34c726c4273414af4e5f8c08d509f38c8ee9fb8f7086de6a0c63de8ab535d9ee1f29ba5e9b1b233c59a2314e3c99685dbf76c28b11add00ad58
SSDEEP

98304:QNG+KOsOUrthQ218cyj8Zb9TcJ/uSAD/EeA70s/ceqZqLSRU:1+IOUUk0899AJ/unEvrl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 1768	3028	rundll32.exe	28
PID 3028 wrote to memory of 1768	3028	rundll32.exe	28
PID 3028 wrote to memory of 1768	3028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Osu\optimization_guide_internal.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3028 -s 172
  2⤵
  PID:1768