66d98baccf204383ee64d744e01305be78428acb6218042f8bdea6bcda82a8b6

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 17:26

Target

Plugins/FX/reacomp.dll
Size

334KB
MD5

8cda4c2b82ae532c40f7c995d1bbeea4
SHA1

400c60d04ec9100eda97177459136a36cf23c98c
SHA256

bb77cc14a449852ad64d7243a4864eb363e091f19aee9a8af1fad65e42d09ea6
SHA512

40be27b61e22d5d3e18c8b69a67c5c12057a799e404d0c8bda103789113ce3f17eb587b84ac25a93293fc1812fa3b3134c232cc896fb0d4e64e0321cbdbdf5d3
SSDEEP

6144:0rtW9yrJXx7s/8z0vSCnTVPbhBLdHCXjmZOKDzrJmIAwX5rYU7L:mtW9cB7s/8z0vSKTNbnZCTmJD3JdyUv

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2820	2776	rundll32.exe	30
PID 2776 wrote to memory of 2820	2776	rundll32.exe	30
PID 2776 wrote to memory of 2820	2776	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\FX\reacomp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2776 -s 80
  2⤵
  PID:2820