c0c017f18b0afe8d9fd84617fb87153ac2ffd01f93db2e9b13144f3e242277da

Analysis

max time kernel
28s
max time network
21s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 03:45

Target
Azurite x64.dll
Size 779KB
Sample240601-ea5teagg6w
SHA256 e1798cbe49ea37f89eaafb0ccdef31833101ce7ff2fad1412ef6c794c89178c4
MD5 352454596ba5f4caeb014dfbc3e25677
SHA1 f707a7aea8bf98d9120c0fb6ada9e868be14d760
SHA512 6cbb108f0658a6cdf067587cd79c3ec65d95aa17d99a50a6f43fce3e74c75290c2e2027f98811f8d9fc7f23e576c5b8813a9682aacf4fa6a29b13d1e76cf84bc
SSDEEP 12288:e2sUK7+shfpdqNgxg54LLXnb5sEE4e8gITENoE2Ne6f9o/7uC7U:e24aSfpjg54LzNDi4J07i
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2572	2916	rundll32.exe	28
PID 2916 wrote to memory of 2572	2916	rundll32.exe	28
PID 2916 wrote to memory of 2572	2916	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Azurite x64.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2916 -s 172
  2⤵
  PID:2572