e4489273eb27325f1b08ed1c5f210924c49a50ca617099d1ff69dd922eef00dd

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 10:39

Target

resources/app.asar.unpacked/node_modules/get-fonts/binding.dll
Size

125KB
MD5

45b0b89ce4455893ef9b673fac89e4ca
SHA1

984b2cd79c31cd1dccb7e5502e893480bd386768
SHA256

7e13ef159c21d63e7749fe47c098d872e38d63d34e6abba7be37bcbe8607ce82
SHA512

b922297c4ed81831a9683f3ee67fca90a573e78111bad7f2d5a56ecbb19bd23eb8b183a918078131a2479a61ec774b4029efdc6ce4d6710a933627d08e128141
SSDEEP

1536:i7fuD1g0RHZIvUq+caOuFFhK5ySskeOTwyvJcEOeJgJsW9d09dlLH+PvKi:i7f8RHlq+caOSa5ylQTwyvJCeeM5e6i

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 3004	1920	rundll32.exe	28
PID 1920 wrote to memory of 3004	1920	rundll32.exe	28
PID 1920 wrote to memory of 3004	1920	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\get-fonts\binding.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1920 -s 92
  2⤵
  PID:3004