b56f3ef36c1a05d0bc5b28b9bc7e38a5f8d8ff49c05fab2c686976fd195f73fa

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 17:34

Target

Inject/_internal/libffi-7.dll
Size

32KB
MD5

eef7981412be8ea459064d3090f4b3aa
SHA1

c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256

f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512

dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
SSDEEP

384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2156 wrote to memory of 2072	2156	rundll32.exe	WerFault.exe
PID 2156 wrote to memory of 2072	2156	rundll32.exe	WerFault.exe
PID 2156 wrote to memory of 2072	2156	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Inject\_internal\libffi-7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2156 -s 80
2⤵
PID:2072