20a694b2cf74788ddf00dd7b0cb8477f385e167d0b3f5872e4da996bd862a6df

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 17:15

Target

Xpander/BoolInverter.dll
Size

70KB
MD5

b307d7d9500e6997fcd2cebb2fab7f57
SHA1

ee9c584224a1dd2defd0bb29e9421a10cf87bc58
SHA256

dd9a813ba8c7e50a22c7ad6fd81b252f59552f9da0ceb61c4e4ce889ece8dd67
SHA512

dd3f13b9fd103301ad54b60ff6b84b117afdc745814024c14cf01f14756f4e950deaf131515c8c26477e7958387386525c4cb4cc64ac7e434cf7ab3d44d315ac
SSDEEP

768:LH8OZRKKDqhBnq+wnXz6YG15Xi+evupb0b/TxZJMlkq2/tHj22Ga:TJR78FGnOYm8ebMtZJMlkpByC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1716	2512	rundll32.exe	28
PID 2512 wrote to memory of 1716	2512	rundll32.exe	28
PID 2512 wrote to memory of 1716	2512	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Xpander\BoolInverter.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2512 -s 80
  2⤵
  PID:1716