da96ab9066c82c4c0350c25d4dc0486472c9ab620dc353768ed31846bef60dd7

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 11:17

Target

$SYSDIR/lame_enc.dll
Size

232KB
MD5

aced3cc66b2940055763837783597c81
SHA1

47c2fd4e5666ec463c3a1b035f44ffe54ed596af
SHA256

54ec306be159a8626f5b80350a3ef2d950f72b85d068bd1db3abf03a04109de0
SHA512

6e107bdb6ef20064fc825191db2f96a9434ceeb30d6a4f9bf54308cac28a324752a7a36e9ca2cb520a5615ef0ff7cc15ee49383bc17a48bf0761b4c5097978d3
SSDEEP

6144:/ntXY/ZE8glYQz0bkDCgdXug4amHUaaZZZZZYRcNj:/ntCZdg2Vb2d/7aXamc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2012	2984	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2984	2932	rundll32.exe	28
PID 2932 wrote to memory of 2984	2932	rundll32.exe	28
PID 2932 wrote to memory of 2984	2932	rundll32.exe	28
PID 2932 wrote to memory of 2984	2932	rundll32.exe	28
PID 2932 wrote to memory of 2984	2932	rundll32.exe	28
PID 2932 wrote to memory of 2984	2932	rundll32.exe	28
PID 2932 wrote to memory of 2984	2932	rundll32.exe	28
PID 2984 wrote to memory of 2012	2984	rundll32.exe	29
PID 2984 wrote to memory of 2012	2984	rundll32.exe	29
PID 2984 wrote to memory of 2012	2984	rundll32.exe	29
PID 2984 wrote to memory of 2012	2984	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\lame_enc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\lame_enc.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 224
    3⤵
    - Program crash
    PID:2012