98872c915e12259499f1f1a27a6ace74e0b39853bac86f2465ecd9d8140c825f

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 04:09

Target
WinToUSBPortable/App/WinToUSB/bin/Qt5Core.dll
Size 5.3MB
Sample240530-eq9sasfa28
SHA256 d6514f0c26848e52f21409a83121e4c6016d755a042a0421384a35e85c4ef083
MD5 e56adb37f382933d253b5cc6c03558e3
SHA1 86aa67707ef59ad105d7b93922df5080c777dbed
SHA512 8f6d9004921c529055e61b484beaf278586abfc7d2b3eb0f5c1b7ab849ece69594a2381891386930a9f0756fa49a0cab0204d29face3cdd2cdc9d4cb443c9f38
SSDEEP 98304:QKAun4YNzLUbvyJsv6tWKFdu9CTTzRWHfej:QKAE4YNzLU+Jsv6tWKFdu9CTZWHfe
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2180	2220	rundll32.exe	28
PID 2220 wrote to memory of 2180	2220	rundll32.exe	28
PID 2220 wrote to memory of 2180	2220	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WinToUSBPortable\App\WinToUSB\bin\Qt5Core.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2220 -s 168
  2⤵
  PID:2180