397ff48f9ae2034c72bb9428427fbf6eca8df5b215723ba31094cf323f32df5e

Analysis

max time kernel
112s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 05:58

Target

$APPDATA/Hotspot Shield/report/af_proxy.dll
Size

934KB
MD5

3388d55bc7d9eb92982d342299910494
SHA1

1aa8fb72c4fc2f2d7e9e3824a11092701662efb9
SHA256

ac0c99a3ae9be803993d7ec8e346d62477425f591eb7c4854d4a0a3c0a1c2a45
SHA512

51742f95f3b710229e13e429fd737a114e8f10ca7c73ad6307059dd6ade58da7a7e470274467f91ba63654c738fd87eb255573f9bc851a8df4b034297df04f7f
SSDEEP

24576:BbCNa0PsR7NPEHnWP+OUnAi24X1+u8vvW:W6uHnWP4AwX8lvO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2352	2536	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2536	2524	rundll32.exe	29
PID 2524 wrote to memory of 2536	2524	rundll32.exe	29
PID 2524 wrote to memory of 2536	2524	rundll32.exe	29
PID 2524 wrote to memory of 2536	2524	rundll32.exe	29
PID 2524 wrote to memory of 2536	2524	rundll32.exe	29
PID 2524 wrote to memory of 2536	2524	rundll32.exe	29
PID 2524 wrote to memory of 2536	2524	rundll32.exe	29
PID 2536 wrote to memory of 2352	2536	rundll32.exe	30
PID 2536 wrote to memory of 2352	2536	rundll32.exe	30
PID 2536 wrote to memory of 2352	2536	rundll32.exe	30
PID 2536 wrote to memory of 2352	2536	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\Hotspot Shield\report\af_proxy.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\Hotspot Shield\report\af_proxy.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 244
    3⤵
    - Program crash
    PID:2352

memory/2536-0-0x0000000061B80000-0x0000000061B98000-memory.dmp

Filesize
96KB

Download