98872c915e12259499f1f1a27a6ace74e0b39853bac86f2465ecd9d8140c825f

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 04:09

Target
WinToUSBPortable/App/WinToUSB/bin/Qt5Gui.dll
Size 5.7MB
Sample240530-eq9sasfa28
SHA256 b2f2b83b73898a1349e865387c5ac6bcfcb3b60262d86756fcaa719e11764962
MD5 76b128b63cd4da34ba9331f18d5f134d
SHA1 bf63a4acf3b7f0fcef49d45ff86f2bdc26b1ff53
SHA512 6526f551dd18de82ee93f1abf8f40eb43d057716c76b85c19f0502a5bc7d406d5d0f3d390e9139bcac395e35ce300ddf7e27e41060967818632345b41f30ff16
SSDEEP 49152:ujzhLDsRlJQJaC1jy/vm6Rl7TrWY/toKivPCnCxq6udDWE3n2ztbgRY+2ScqT4QK:EzJsSHwv7Rl/JC4njG3+2C4QAH
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2180	1848	rundll32.exe	28
PID 1848 wrote to memory of 2180	1848	rundll32.exe	28
PID 1848 wrote to memory of 2180	1848	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WinToUSBPortable\App\WinToUSB\bin\Qt5Gui.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1848 -s 168
  2⤵
  PID:2180