5198872d1ff0389f7e076469095a972a2df0fbcd96e970edaab5525a55d10e7e

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
06/06/2024, 15:45

Target

ea_desktop/version.dll
Size

238KB
MD5

df7eabf56d49ebd775f92fa67a0071d6
SHA1

7dff8092b62a7f400e3aef760e643ad948d533c5
SHA256

d6086904aa3c47a04f9651cad2d2d4be3d50ae93b4bbc5b5b7bd63dc86eb2ec6
SHA512

ecfb1e8e259fbcb45c00c858a90d11a73304baea9f27474c9ffd439177098412f6009dc8f5ef48ab496e82910a5454836a7c33c3e82cbb9dfb5c3866b8a880f6
SSDEEP

3072:8iPe/BusENL4M8MzYg2GOPSkc+0j6kML3lHq91QQevXDDsC1fxgKT/mqs/KFQizn:LPe/BKVmqkQ6kMB5HnsSFQP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2436	2416	rundll32.exe	28
PID 2416 wrote to memory of 2436	2416	rundll32.exe	28
PID 2416 wrote to memory of 2436	2416	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ea_desktop\version.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2416 -s 92
  2⤵
  PID:2436