d2623ed0469b4a7a8f9371cb91bad7bb803564bdda76fdcc5972905edb12f8b9

Analysis

max time kernel
13s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 18:47

Target
icudt30.dll
Size 1.5MB
Sample240704-xffqksvgrd
SHA256 8c04f1ab3a07e21e88d678e6742efc69900bacf73b1e18f97b25115d3cb3e4d5
MD5 38bb7cee2aa52930485939771c44ab2a
SHA1 dd028b21c611873c28de3e80f04e787250f97219
SHA512 b8169042f45b7fd08e7aab17a05fe48dca8ffd203d3b841a990d8836da33bcfaf39ee5953706281c4a47148736c5ed1d51956eca6e8efb67af9d137e1dfe7849
SSDEEP 24576:KqaX8Bv2axcToy/oH0C/iwESlzJ5uM8H2ZIuNjMSpnhmW8c238uoL/:88BvPy/i0CKwFEvnckB
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 1732	2396	rundll32.exe	30
PID 2396 wrote to memory of 1732	2396	rundll32.exe	30
PID 2396 wrote to memory of 1732	2396	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\icudt30.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2396 -s 84
  2⤵
  PID:1732