4fda471663f28d238af3e66a7ea99b1510a5ca4d36c12484ef4057c556f7f40d

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 14:23

Target

resources/extraResources/boost_program_options-vc90-mt-1_58.dll
Size

335KB
MD5

00ab4a4aa0dae3f28c1b794c6ae852ed
SHA1

ec1186fd1da950079a61db29aa7569961f39d8bc
SHA256

636d6e0d3f37f1b9bb8421098d803e371fb2cf27908503d5dcd61b9018eb4611
SHA512

cd5cd6fb647366a8b20eb2dfc2ca4cd8982e09c5a462e67f10541f5261fe6a013af409b7f7f8ee20c7931e6c1ca5d8a94bc8aa1b7e4b14ce872bb4279ebee56b
SSDEEP

3072:FafTjiIGCbi4Mp7d57LZevMCWzy3NRWjmhlxBjOyB5XbVGfjdW/B:gfT2IVbihLDD1mhXBjOyBR5Am

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1908	2464	WerFault.exe	31

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2464	2484	rundll32.exe	31
PID 2484 wrote to memory of 2464	2484	rundll32.exe	31
PID 2484 wrote to memory of 2464	2484	rundll32.exe	31
PID 2484 wrote to memory of 2464	2484	rundll32.exe	31
PID 2484 wrote to memory of 2464	2484	rundll32.exe	31
PID 2484 wrote to memory of 2464	2484	rundll32.exe	31
PID 2484 wrote to memory of 2464	2484	rundll32.exe	31
PID 2464 wrote to memory of 1908	2464	rundll32.exe	32
PID 2464 wrote to memory of 1908	2464	rundll32.exe	32
PID 2464 wrote to memory of 1908	2464	rundll32.exe	32
PID 2464 wrote to memory of 1908	2464	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\extraResources\boost_program_options-vc90-mt-1_58.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\extraResources\boost_program_options-vc90-mt-1_58.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 228
    3⤵
    - Program crash
    PID:1908