004be9ec7982c94c19af5386132c96e4518e55dd940d895c7e68a6a869c1fee7

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 05:18

Target

nazimod-runtime.dll
Size

2.4MB
MD5

a109132a4a95380eb420abf0c601b487
SHA1

5cc4fcf120b536ec294a31db486f4f95fea4cd60
SHA256

9b638dfe770a259a13ca7e84c896944b1d709eb4139343075b25209261ec5008
SHA512

d635d130fe3b29020cb2a632fa0e58651f784dea9793388e1980f52b341bacad6b14a0589277eb804cf0e715e2825febf45fa4ed36bcabd900d15cc00d5e2094
SSDEEP

24576:szeX0wWMJquVs8y7hnusJN+e5UanxpWtRWSbQ9qVyjBCSvwKJP:sZqhVKuiN+e5UanLWt9bCqVmoSIKJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2464	2460	rundll32.exe	29
PID 2460 wrote to memory of 2464	2460	rundll32.exe	29
PID 2460 wrote to memory of 2464	2460	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\nazimod-runtime.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2460 -s 136
  2⤵
  PID:2464