4fda471663f28d238af3e66a7ea99b1510a5ca4d36c12484ef4057c556f7f40d

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 14:23

Target

resources/extraResources/boost_regex-vc90-mt-1_58.dll
Size

712KB
MD5

3a8c0dce96d6a6da853428ace9de64df
SHA1

85f3671793ffdd7232ccda9e41d3d19b0f8d9255
SHA256

c831338c2c76d1a2dea8b65dd299ee65c8c15bf98338d03b502d87894b7546bc
SHA512

745f2e04d92c437a8930d6fc989b7062467064cb16ea39abcbd49f54d9ae452d6c9405c63cec3da8c785d00bb524336708f96ba69a16d1623428e847306e7204
SSDEEP

12288:DgR5mt76tAbSaR9lpurfWRkcmvWEXKNPu5CA+bzJji30XQV2bDFfaJWMBszyaJ+S:MmV6abSaR9lpurGmnb+XJji30AVeYWMQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3000	1664	WerFault.exe	31

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 1664	2988	rundll32.exe	31
PID 2988 wrote to memory of 1664	2988	rundll32.exe	31
PID 2988 wrote to memory of 1664	2988	rundll32.exe	31
PID 2988 wrote to memory of 1664	2988	rundll32.exe	31
PID 2988 wrote to memory of 1664	2988	rundll32.exe	31
PID 2988 wrote to memory of 1664	2988	rundll32.exe	31
PID 2988 wrote to memory of 1664	2988	rundll32.exe	31
PID 1664 wrote to memory of 3000	1664	rundll32.exe	32
PID 1664 wrote to memory of 3000	1664	rundll32.exe	32
PID 1664 wrote to memory of 3000	1664	rundll32.exe	32
PID 1664 wrote to memory of 3000	1664	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\extraResources\boost_regex-vc90-mt-1_58.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\extraResources\boost_regex-vc90-mt-1_58.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 228
    3⤵
    - Program crash
    PID:3000