b621718ffe64748590ea9568fbbed0f3d86b0939906dc9f7fe064e20ce385492

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 09:26

Target

intl-8.dll
Size

95KB
MD5

b21cd0b402000e4f20a4372b3d94facb
SHA1

75d052510445aa43059f18c0fcf0fdaef5b5ef54
SHA256

4d62ad9661460c6377eb88e46ef7ee108e0dd72d0e8da8354eb00c5caf0ed3c6
SHA512

45649883a7095adc569a72082c8024409942356e7e4f7213d8e7c7013f08126526415e1d99f391f3b2ab8f8e5580611578bf0fab84b4a79421468afddee3e43c
SSDEEP

1536:hPMqq7gvpDhtteBo1we7kCcLYVM1KIwSqNUMhEMb4004k+f/QZcFQiPESvhxNy/L:NMeDsh8VMcIwSUEMb4004NfYZ6ESvhx8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2668	2008	rundll32.exe	28
PID 2008 wrote to memory of 2668	2008	rundll32.exe	28
PID 2008 wrote to memory of 2668	2008	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\intl-8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2008 -s 88
  2⤵
  PID:2668