5942143614d8ed34567ea472c2b819777edd25c00b3e1b13b1ae98d7f9e28d43

Resubmissions

11-07-2024 04:40

14-05-2024 04:59

max time kernel
15s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 04:40

Target

5942143614d8ed34567ea472c2b819777edd25c00b3e1b13b1ae98d7f9e28d43.dll
Size

1.0MB
MD5

2b7fc9dd400d92cc64627115b47a592f
SHA1

7131a6f16aa8534a9cec7e11e37423aea4c09784
SHA256

5942143614d8ed34567ea472c2b819777edd25c00b3e1b13b1ae98d7f9e28d43
SHA512

50a8c9f9b0daa160d3ab7eb49212a53db7c4aa1aa02c7a408ffc2254c02635be9c52c815567e9020beb4eb3a9d6aaa919c70f87d01fc6df55b0e4785b21d28b8
SSDEEP

24576:9gV5fnVwQncvBPaMQguPhZDrBvyTagWIO:9g3VwkYaM0PvfBqugx

Score

1^/10

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.5n0hklvqf\DefaultIcon	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.5n0hklvqf	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.5n0hklvqf\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fkdjsadasd.ico"	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2560	2644	rundll32.exe	30
PID 2644 wrote to memory of 2560	2644	rundll32.exe	30
PID 2644 wrote to memory of 2560	2644	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5942143614d8ed34567ea472c2b819777edd25c00b3e1b13b1ae98d7f9e28d43.dll,#1
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2644 -s 304
  2⤵
  PID:2560