20a694b2cf74788ddf00dd7b0cb8477f385e167d0b3f5872e4da996bd862a6df

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 17:15

Target

Xpander/Switches.dll
Size

162KB
MD5

9ea6a95a0346003600b9fadba09a2a87
SHA1

579fb9090159d3f9078331afdc61c6de0aa12670
SHA256

92654614ea106cc1d5c9cced19d013dfac623be6871da12ddcff665b33814aae
SHA512

0f0f3b9e66c0640f386b16fbd045ae93d87b66f6e8f970f4674c207e66e52d5aa1e3a3737d2107905893c853a82c37638f08d589edadc50d79ee521b97575911
SSDEEP

1536:nAkJAb/TrZnNK/pqasLWRV103QvMX2mXmMuLORy08eyLha7UU1HQW3MVn7mtlmue:nAkqAQascbbG8eyA7UQOn7mtUuuJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 1692	620	rundll32.exe	28
PID 620 wrote to memory of 1692	620	rundll32.exe	28
PID 620 wrote to memory of 1692	620	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Xpander\Switches.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:620
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 620 -s 80
  2⤵
  PID:1692