bb227aa7b0404ccac254372c91ddf2e307526aa82ed9c4ecd3e495c38a6b4552

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 08:19

Target

MedicareSign/astclient.dll
Size

675KB
MD5

7bf95a14483346eae890e6f4354c74a8
SHA1

7de11b13cfe609d454bdd1393ed3d79a127c1b7c
SHA256

719f267e41c95e36f99f5da0b9d5d70054d3e9c16e99fb1122948382b976d614
SHA512

ef8b24e6079f05b3f1253e4487e1426639ceb5c1e13ca80046debd224353280e921ea765958f5b3f564983992a294e0242fd7bf4753cce24c51caa86557b51fe
SSDEEP

12288:eVX2O3PmDFam0YxykOeH74CMDEnvpWua1ph0lhSMXlCIVktHFlAP:QGMmbjxyk144vpWukh0lhSMXlaDAP

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\log\AstCln240715_2128.log	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2592	2128	WerFault.exe	31

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2128	2452	rundll32.exe	31
PID 2452 wrote to memory of 2128	2452	rundll32.exe	31
PID 2452 wrote to memory of 2128	2452	rundll32.exe	31
PID 2452 wrote to memory of 2128	2452	rundll32.exe	31
PID 2452 wrote to memory of 2128	2452	rundll32.exe	31
PID 2452 wrote to memory of 2128	2452	rundll32.exe	31
PID 2452 wrote to memory of 2128	2452	rundll32.exe	31
PID 2128 wrote to memory of 2592	2128	rundll32.exe	32
PID 2128 wrote to memory of 2592	2128	rundll32.exe	32
PID 2128 wrote to memory of 2592	2128	rundll32.exe	32
PID 2128 wrote to memory of 2592	2128	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\astclient.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\astclient.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 288
    3⤵
    - Program crash
    PID:2592