a4f7b21dc88bdcf27cbe929d4bba979f759320b53f7e826bc0a77f55ebbf866c

Analysis

max time kernel
119s
max time network
134s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 01:07

Target
!ŞetUp_51286--#PaSꞨKḙy#$$/Libs/Injecting.dll
Size 507KB
Sample240706-bgs7ea1dmn
SHA256 1d65ed9e476136a6608c7547539cea5b5c888b177ca93aeaa67b2466ada3982a
MD5 da2b07289f9853d57b19a5299e0e763f
SHA1 9f38aa225429081b1a25100177b05dee8cd0a02a
SHA512 466cb7b1e19ac5ebb4c1186bfb74b95ae8b21f621cbd538060c45df1d62520f9b03bad9ce19c30143ad1b04d47bcb1d4235c8d519647ecbcd6ec13b2cf5ddd69
SSDEEP 12288:Md+At7LVue0pEt/g+mKCPVIHM9uSLllGKV:M0CiQXmPdIHofwE
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2384	3036	rundll32.exe	30
PID 3036 wrote to memory of 2384	3036	rundll32.exe	30
PID 3036 wrote to memory of 2384	3036	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\!ŞetUp_51286--#PaSꞨKḙy#$$\Libs\Injecting.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3036 -s 88
  2⤵
  PID:2384