5497ea567644f9539497d11cc3e85eb507013d6260ec2d8aa2d914d80a586080

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 00:52

Target

RLuncher_1.5.0.3/Other/App/Edgar/libfreetype-6.dll
Size

572KB
MD5

42ab9dd5740879c8a0913047149d3a60
SHA1

d117ef70d0100615b5d50fb555345545e823235b
SHA256

8e263fd9257e8e83bafda0c943184a498c07424c4d558321fdb48c9a197e58a4
SHA512

5c0656521815cb504a1e840fd0163b0eb10d6b7237dbb76c6bdbf66388111667fb1d4fe78c2bbe8d00d377cf150200142ce7e33cb5434960f69a77899322b417
SSDEEP

12288:w7AvRbpuflWqWyhb/e+AUCnGqI3qoTF1OgfEWm:w7AWVhbm+AWqc5uZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 2092	2560	rundll32.exe	28
PID 2560 wrote to memory of 2092	2560	rundll32.exe	28
PID 2560 wrote to memory of 2092	2560	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\RLuncher_1.5.0.3\Other\App\Edgar\libfreetype-6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2560 -s 80
  2⤵
  PID:2092

memory/2560-1-0x0000000062E80000-0x0000000062EA4000-memory.dmp

Filesize
144KB

Download
memory/2560-0-0x000000006AE80000-0x000000006AF17000-memory.dmp

Filesize
604KB

Download