66d98baccf204383ee64d744e01305be78428acb6218042f8bdea6bcda82a8b6

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 17:26

Target

Plugins/FX/readelay.dll
Size

294KB
MD5

81602b9d892323f6836e263dfbe41146
SHA1

10bd09b41a0cce28aea0342ebdc0e059dc315f64
SHA256

11f302ef46850a8b7ef001f67386e2d6cd789843689b38a3f5dfe5aa24bad6ee
SHA512

7f388445d10f57e0e5325afd242c788ba90379198ba293677ec66c31bf95d2c5594ffbaa1c5d99464540aa3b81cd484f9df0698b31b348438d17cb16d6efb1a6
SSDEEP

6144:EOFOjUPO53uUKAc/HbrNn4yl69AcwZOMHtkQJblw/5rYs1OK1G:EOMjU5UKAc/Hb1499lwfHNJ3joG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 1912	2168	rundll32.exe	31
PID 2168 wrote to memory of 1912	2168	rundll32.exe	31
PID 2168 wrote to memory of 1912	2168	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\FX\readelay.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2168 -s 80
  2⤵
  PID:1912