9d0eef3560fd3b6f9207a21206c4f4337b07bff2cf082869c87bdc1ddd6d2e89

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 14:48

Target

Osu/optimization_guide_internal.dll
Size

8.2MB
MD5

9e50f4a2f8d4785401009acd9e44cc50
SHA1

91351d9519920388fcbd5854fc4abf86757547d4
SHA256

545de3597fef20c3ac15e728a4fa687f90978d756311f248421f43018c44e900
SHA512

03f5dbea2a96f34c726c4273414af4e5f8c08d509f38c8ee9fb8f7086de6a0c63de8ab535d9ee1f29ba5e9b1b233c59a2314e3c99685dbf76c28b11add00ad58
SSDEEP

98304:QNG+KOsOUrthQ218cyj8Zb9TcJ/uSAD/EeA70s/ceqZqLSRU:1+IOUUk0899AJ/unEvrl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2172 wrote to memory of 2392	2172	rundll32.exe	WerFault.exe
PID 2172 wrote to memory of 2392	2172	rundll32.exe	WerFault.exe
PID 2172 wrote to memory of 2392	2172	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Osu\optimization_guide_internal.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2172 -s 172
  2⤵
  PID:2392