618147921193bf9d912bb88a5bb91cc915b59617df7daecce0e41ff51ac06a63

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 04:00

Target

$APPDATA/seemao/config/Common.dll
Size

223KB
MD5

018801e2cdc880f3486ab758b1cc891a
SHA1

18165ac67c1d2f0c13d052242711451ea8a48cee
SHA256

1ef4f56fc3a08472c995b44a5d03099d30dd9eedc2efd25e6c7fed973c811647
SHA512

5cba9f59c4836cf488b5639955eca51910a7908654412806f03c068eec02be3e5d87b6418b16f6d6e60ca47a1cb75813614578d9c4db6a30de0b104f6c738f11
SSDEEP

3072:OVJcr9gEeXPAwe1dKnL/p0mDCx6P89TBfKp18tlSu76qeD:OVJdEe/AP1czKme9TBCp1juuJD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1484	1940	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1940	1492	rundll32.exe	28
PID 1492 wrote to memory of 1940	1492	rundll32.exe	28
PID 1492 wrote to memory of 1940	1492	rundll32.exe	28
PID 1492 wrote to memory of 1940	1492	rundll32.exe	28
PID 1492 wrote to memory of 1940	1492	rundll32.exe	28
PID 1492 wrote to memory of 1940	1492	rundll32.exe	28
PID 1492 wrote to memory of 1940	1492	rundll32.exe	28
PID 1940 wrote to memory of 1484	1940	rundll32.exe	29
PID 1940 wrote to memory of 1484	1940	rundll32.exe	29
PID 1940 wrote to memory of 1484	1940	rundll32.exe	29
PID 1940 wrote to memory of 1484	1940	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\seemao\config\Common.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\seemao\config\Common.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 224
    3⤵
    - Program crash
    PID:1484