4245b59eb49f9ea2596ed1791ea2c81173acbfdfa2ceaf8e17ab418ace71d847

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-06-2024 18:10

Target

CrashSight.dll
Size

3.5MB
MD5

030673a7f2fe74ec7629dc5ed914b952
SHA1

5ac4a9962c3c6570a58eeac44f1dff32450cc33e
SHA256

8fd13c188935120339cd6c935f9e43034331dc5dc79a90b1d2d0f8bb92973705
SHA512

5ad4cd9a3c83040f2df6c33cf64d660267ebe6b9d34afa7a9ea26c9f6238e4943e65f73a4dbede609d6dfdd68b0f7121c47d7b6e72d1b5153e35016d0bcbb847
SSDEEP

49152:GAX5oOmQF+b75HDczMkeMwgO/AG+FnT0egIu0ODpvRezZadW/FCPJMHOPvTQHTs6:GAXapQFYRorbwEG+qjreIeyMHf

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2252	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2252	1636	rundll32.exe	28
PID 1636 wrote to memory of 2252	1636	rundll32.exe	28
PID 1636 wrote to memory of 2252	1636	rundll32.exe	28
PID 1636 wrote to memory of 2252	1636	rundll32.exe	28
PID 1636 wrote to memory of 2252	1636	rundll32.exe	28
PID 1636 wrote to memory of 2252	1636	rundll32.exe	28
PID 1636 wrote to memory of 2252	1636	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CrashSight.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CrashSight.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2252