387ae43099fee9234854e9c8ebe1b4ae42c22f5b952446334c6335587899deee

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 16:01

Target

bin/k2epack/Plugins/NotifyIcon.dll
Size

5KB
MD5

9ab83d7ef9bd55db63ceb33840431cd5
SHA1

548c54c8b9d683f32b2f1bd8b3f374fc14691fd4
SHA256

d2b04b5b33877521f6f140148521f219e25d2de753ff20954f90dcee55d1a647
SHA512

5fbceba72421834d5b888818b1fea5f88c518ad871539a3ff1422d4a3e3d6bb945dca1da0839158c446e54cdc5c916e1ca17283b44135d2078bb1188ae142545
SSDEEP

48:aFV2n5RPl5A9+DyhKqfCdGMfMGMoTtmZE+dlpn6sT6lQQAsjRz:s05RP72BCdjUGM4R+dHn6tV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2976	1916	WerFault.exe	28

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1916	rundll32.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1916	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 1916	2392	rundll32.exe	28
PID 2392 wrote to memory of 1916	2392	rundll32.exe	28
PID 2392 wrote to memory of 1916	2392	rundll32.exe	28
PID 2392 wrote to memory of 1916	2392	rundll32.exe	28
PID 2392 wrote to memory of 1916	2392	rundll32.exe	28
PID 2392 wrote to memory of 1916	2392	rundll32.exe	28
PID 2392 wrote to memory of 1916	2392	rundll32.exe	28
PID 1916 wrote to memory of 2976	1916	rundll32.exe	29
PID 1916 wrote to memory of 2976	1916	rundll32.exe	29
PID 1916 wrote to memory of 2976	1916	rundll32.exe	29
PID 1916 wrote to memory of 2976	1916	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\k2epack\Plugins\NotifyIcon.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\k2epack\Plugins\NotifyIcon.dll,#1
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 224
    3⤵
    - Program crash
    PID:2976