209a4474cb7f906d4fd6c7df839841b7944b4917ec5f65bc0c92acfa552f9040

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 07:44

Target

$PROGRAMFILES/Bench/BService/1.1/bhelper64.dll
Size

108KB
MD5

1ee6f52ca4a576a5a21f11bc91634fa1
SHA1

cc88403e0541a0f8ab9ebc3beb4eef27132cee1d
SHA256

eee40028b8d3074cdd8c44714c04ee514578fddc21bcad9fb35624b4ab3e7865
SHA512

1295e08d0cc43c6297ede90aff02f75783939dfe39b6a93de0a701de2e2c84325e6b17374e4adcdf975579935c2cbd6ba39c840ec2bbe2e0bb5908921298d106
SSDEEP

3072:NJHbTyRbZEkU8lQYU8j6A6pTmAFWnv23iNQtm:z7Ty5gMQYU8j6pgAF2uQQt

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2460	2644	rundll32.exe	28
PID 2644 wrote to memory of 2460	2644	rundll32.exe	28
PID 2644 wrote to memory of 2460	2644	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Bench\BService\1.1\bhelper64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2644 -s 112
  2⤵
  PID:2460