4fda471663f28d238af3e66a7ea99b1510a5ca4d36c12484ef4057c556f7f40d

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 14:23

Target

resources/extraResources/boost_iostreams-vc90-mt-1_58.dll
Size

48KB
MD5

3c137fb13a39574125a40ad93c0ca73d
SHA1

625904713ac5e72839b41bcd96a3ef3fa727277c
SHA256

d21d1fae5ad6561855b2028f0babb19993cdd2e258e9ff01c40f9aafbf296d03
SHA512

f456de2d5a2c39133d042aea2832790606bd19ea4d6f8f9e2f68ef3301d316077a7d42cdd92811c9392325de536098bdc7f796c410b4d1e6b9e91a9520f5b624
SSDEEP

768:wmuYRe/bMAueOLlDtqkKSKfaOX+OttHDKA85YiDnpAMxkEarR:wmuYM/bMAueOLlDtQS0afOtZ27Dxx+rR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2528	2040	WerFault.exe	31

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 2040	1880	rundll32.exe	31
PID 1880 wrote to memory of 2040	1880	rundll32.exe	31
PID 1880 wrote to memory of 2040	1880	rundll32.exe	31
PID 1880 wrote to memory of 2040	1880	rundll32.exe	31
PID 1880 wrote to memory of 2040	1880	rundll32.exe	31
PID 1880 wrote to memory of 2040	1880	rundll32.exe	31
PID 1880 wrote to memory of 2040	1880	rundll32.exe	31
PID 2040 wrote to memory of 2528	2040	rundll32.exe	32
PID 2040 wrote to memory of 2528	2040	rundll32.exe	32
PID 2040 wrote to memory of 2528	2040	rundll32.exe	32
PID 2040 wrote to memory of 2528	2040	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\extraResources\boost_iostreams-vc90-mt-1_58.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\extraResources\boost_iostreams-vc90-mt-1_58.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 228
    3⤵
    - Program crash
    PID:2528