2a29407a012be17087edc4de06d1c4ae96f72ae52097aaa98bc2707d7d7624c7

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 01:22

Target
Plugins/FX/reacast.dll
Size 418KB
Sample240612-brbecaxenc
SHA256 59a10f8f4e068c2368c5803fb8070eb3b1408106ebdc18b4110ed38761c26438
MD5 12cc432e707dbb3846c79c85bf616719
SHA1 66c2cd0d827b6d6149b842d3ed64e6b83d985993
SHA512 21f53487c9b408a1195cd801b29aae1197d01218fc5bb5ccb73a6b120faa23c5fe63e528bc674dd6f770667f41109214bd923d5962a9287fbd1fda18e9a9431b
SSDEEP 6144:gq61dhrYNMBAwY5Viu3hU09wuSAPRXpMuIdiwA0IiMqzz+ZqOyOZORKBzgJM1kL2:ghbHlizdPRXpMDiNitzzf/OZkJTds
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 1388	2956	rundll32.exe	28
PID 2956 wrote to memory of 1388	2956	rundll32.exe	28
PID 2956 wrote to memory of 1388	2956	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\FX\reacast.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2956 -s 80
  2⤵
  PID:1388