03ba7ea3ecfb6bd317098ba4b6a7a4fea52253f0318f2f51b2a54c4af5679b24

Analysis

max time kernel
15s
max time network
22s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 02:39

Target

GIPSVoiceEngineDLL.dll
Size

768KB
MD5

78e1d2b8a9b86a3dd01d2685c7b807da
SHA1

73c887c6ed7fbd3092ba8775ecb7b0dd9b4ba0c8
SHA256

6e8eba43b245fb9b07b981c67746c5038536b00f6847adf4f7b8c67fc09e4de1
SHA512

15f43b5ed8b6098dc64897a27950a3388cf402358a012f7b1e2840178a62320bd1290a7494ec40e4169e8c23aeba6da116bf75102bea49749d6589b8db6a620e
SSDEEP

12288:NE+IwiAihoFeCLU2uWGn39/6cuivtqqHGrzDuLU5vDWqnPiY2n:W+IwiSICLXuN9Ccui1vQn5S+PiY2n

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2164	2828	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2828	1636	rundll32.exe	29
PID 1636 wrote to memory of 2828	1636	rundll32.exe	29
PID 1636 wrote to memory of 2828	1636	rundll32.exe	29
PID 1636 wrote to memory of 2828	1636	rundll32.exe	29
PID 1636 wrote to memory of 2828	1636	rundll32.exe	29
PID 1636 wrote to memory of 2828	1636	rundll32.exe	29
PID 1636 wrote to memory of 2828	1636	rundll32.exe	29
PID 2828 wrote to memory of 2164	2828	rundll32.exe	30
PID 2828 wrote to memory of 2164	2828	rundll32.exe	30
PID 2828 wrote to memory of 2164	2828	rundll32.exe	30
PID 2828 wrote to memory of 2164	2828	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GIPSVoiceEngineDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\GIPSVoiceEngineDLL.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 240
    3⤵
    - Program crash
    PID:2164