4824b32e77aaa215c6497d16df9c022feddd5162fc8a3aa67a609150d91b8e92

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 00:15

Target
2345DirectUI.dll
Size 1.7MB
Sample240604-ajw6eaed2w
SHA256 e8a0ec24c8cd45d8422c85f843b9d33a9140a1e1be4ed0e9901c3649106017bb
MD5 b1f8b917d524f8530a153154ff626707
SHA1 a571166e6b1fabf182c880c122ef31085dbb4aeb
SHA512 5de6dad1d66e764a735815719f4bdf3136ee2961e83d7bd3bbfd041b007ff54abd3a97d00233664894d290ca6fcbdcc4fd1dee1e49087a363e71c7713c2b1554
SSDEEP 24576:GfvQEoxYpov2cLaCK4cSdAF/N6x7R3pN6iAy+eywyQ3nlaFBC4IJAmMm40EIW7ys:YHoepov2cLaCZ1AyRR1CM+7jjwfsxl
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 2740	1260	rundll32.exe	28
PID 1260 wrote to memory of 2740	1260	rundll32.exe	28
PID 1260 wrote to memory of 2740	1260	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2345DirectUI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1260 -s 156
  2⤵
  PID:2740