243f3743b7c0353104dffd185aa6d754407e7b31c3840e30fdc5ec66d7f1c11b

Analysis

max time kernel
117s
max time network
141s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 05:35

Target

[3.9.11.19]/VoipEngine.dll
Size

15.0MB
MD5

48a14bca1659e9e28994d66fd2b0d974
SHA1

f630457c392e995c9513ec77cf8cc524c4fc98aa
SHA256

94ff88e96358ec2225076a54bf39ee8df2a74f9c1ad50a4f905b5bdecbea237b
SHA512

1773c5dc08e0412da4e5c9623af0e91e72ca7d8bfd286c31c2cf13e57ae492b14028730c87f8d7471b7aa997024a6a78bdebd6332f32335e600addb2b54cc75d
SSDEEP

98304:DDrxxem5zHZrWKZDz/Wrx+zE5JOfRncJ0nwF25G1epNMn+Rz35rCmW:DDrxxzFWKZDbWrV5AE6MYzhCmW

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2132	3068	rundll32.exe	31
PID 3068 wrote to memory of 2132	3068	rundll32.exe	31
PID 3068 wrote to memory of 2132	3068	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\[3.9.11.19]\VoipEngine.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3068 -s 120
  2⤵
  PID:2132