60d30a20c039c6a27046a2e47fde076895bd48ea4a019fb40f6cf9d75f403592

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 21:29

Target

PaiPai/FreeImage.dll
Size

2.3MB
MD5

5167e215a75753eae72e7834943bae75
SHA1

e9a4769cb17cef314f414ef14238c8c6869a3c66
SHA256

af2a1ae66d9963092a7de6756335caf39a9c2250ecd77bd07e62ca4ac6046259
SHA512

edd747c7332949a4fcb3d601f809acc175aa6fbe80724ed0bbf48ba6f29ec1415fafb0a46a663bd52fb0e5a2e14ed7a453212cd08e74298fd6ff7e07c8937bc4
SSDEEP

24576:nplmUIUWq2i2B+PyB793HjOTM6qoAVEWLx+oylAjPo2vWazbiwpOpTRzTMy8N8GT:npltIUha6ybOgNtQVlAUWzuwqTXC7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1228	2416	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2416	2396	rundll32.exe	28
PID 2396 wrote to memory of 2416	2396	rundll32.exe	28
PID 2396 wrote to memory of 2416	2396	rundll32.exe	28
PID 2396 wrote to memory of 2416	2396	rundll32.exe	28
PID 2396 wrote to memory of 2416	2396	rundll32.exe	28
PID 2396 wrote to memory of 2416	2396	rundll32.exe	28
PID 2396 wrote to memory of 2416	2396	rundll32.exe	28
PID 2416 wrote to memory of 1228	2416	rundll32.exe	29
PID 2416 wrote to memory of 1228	2416	rundll32.exe	29
PID 2416 wrote to memory of 1228	2416	rundll32.exe	29
PID 2416 wrote to memory of 1228	2416	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PaiPai\FreeImage.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PaiPai\FreeImage.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 224
    3⤵
    - Program crash
    PID:1228