bb6b7ebf49d7bb71b60768215b64e7883a8995dd9f145155f3f012874c226ae4

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 15:53

Target

OfflineExplorerEnterprise/Offline Explorer Enterprise/gdiplus.dll
Size

1.5MB
MD5

81246ebdc2139bad569503f10dbed1ab
SHA1

2f48937029647ea114c510e3337704ab5c995d6c
SHA256

0d0ca1dcacdeff34b62a299df13030aa0d5889576f971f990cab5c26c71fafc6
SHA512

b20f37c2a7ebab96b01f886a890cf0fb649e0d769e718060535ec4852739b08ceead7ba373f69f68b2015a5ac15ac37e928431c033b8089df815812cd9d33fec
SSDEEP

24576:0k18V2mHkfIE3Ip9vkWEgDecZV3W9kpOuRw8RhWd5Ixwzr6lOboU7j97S9D+z9lj:0ZNkf+uW3D1ZVG9kVw8I5Rv6lwH9+Iy6

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2236 2248 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2236	2248	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2344 wrote to memory of 2248	2344	rundll32.exe	rundll32.exe
PID 2344 wrote to memory of 2248	2344	rundll32.exe	rundll32.exe
PID 2344 wrote to memory of 2248	2344	rundll32.exe	rundll32.exe
PID 2344 wrote to memory of 2248	2344	rundll32.exe	rundll32.exe
PID 2344 wrote to memory of 2248	2344	rundll32.exe	rundll32.exe
PID 2344 wrote to memory of 2248	2344	rundll32.exe	rundll32.exe
PID 2344 wrote to memory of 2248	2344	rundll32.exe	rundll32.exe
PID 2248 wrote to memory of 2236	2248	rundll32.exe	WerFault.exe
PID 2248 wrote to memory of 2236	2248	rundll32.exe	WerFault.exe
PID 2248 wrote to memory of 2236	2248	rundll32.exe	WerFault.exe
PID 2248 wrote to memory of 2236	2248	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\OfflineExplorerEnterprise\Offline Explorer Enterprise\gdiplus.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2344

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\OfflineExplorerEnterprise\Offline Explorer Enterprise\gdiplus.dll",#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 224
3⤵
- Program crash
PID:2236

memory/2248-0-0x0000000070D00000-0x0000000070E94000-memory.dmp

Filesize
1.6MB

Download
memory/2248-1-0x0000000070D00000-0x0000000070E94000-memory.dmp

Filesize
1.6MB

Download