64f0803dc343b57b1f9114f1bfb9eeacf9d76b193620621561a280827b0b6326

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 19:05

Target

402323332/Files/isbzip.dll
Size

36KB
MD5

e43abb7be44beabca7b75bf25b022cac
SHA1

69c78415a377dbeb2d1dd8c37863c2aeff3e9d61
SHA256

d49058b388f75915ad89a7911caff47f024f4e9204b07c67fcdd7015ac69e9e7
SHA512

58a215adf97dc25ecb74b1bb2e960cca1fd61c04b6b2adfbf585383847f2a1d0fa0cfda542fa49a7fb501be9a52b544647055715d617c0c0ceb2bb23130ba6f4
SSDEEP

384:sMbaCLHqFXUt9EKjIv9OY8pSehac8oI7VzEyZ97e5QDpRPtAsLiA:3uDlIpL+VwC7htN23A

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2600	2428	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2428	2400	rundll32.exe	30
PID 2400 wrote to memory of 2428	2400	rundll32.exe	30
PID 2400 wrote to memory of 2428	2400	rundll32.exe	30
PID 2400 wrote to memory of 2428	2400	rundll32.exe	30
PID 2400 wrote to memory of 2428	2400	rundll32.exe	30
PID 2400 wrote to memory of 2428	2400	rundll32.exe	30
PID 2400 wrote to memory of 2428	2400	rundll32.exe	30
PID 2428 wrote to memory of 2600	2428	rundll32.exe	31
PID 2428 wrote to memory of 2600	2428	rundll32.exe	31
PID 2428 wrote to memory of 2600	2428	rundll32.exe	31
PID 2428 wrote to memory of 2600	2428	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\402323332\Files\isbzip.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\402323332\Files\isbzip.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 224
    3⤵
    - Program crash
    PID:2600