bb227aa7b0404ccac254372c91ddf2e307526aa82ed9c4ecd3e495c38a6b4552

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 08:31

Target

MedicareSign/astrct.dll
Size

1.7MB
MD5

59b0561cc13e47a3d7be7947e9b8a4cf
SHA1

172663ab62e420cbd46983f5dfacac3b550cdb4f
SHA256

e12baf2c64aed23a6d324fd553d5722e5d5d03d50676a0afe97c4090df3cb7c2
SHA512

35d3a4739176c81c5e339c5b64411cd0cbb24b2343792e2af302a585b984c158140a20050fd8015a4d49c2a69bbd31aad82a4f58e8279611ec262499dab6bd41
SSDEEP

49152:NSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwww1:NSSSSSSSSSSSSSSSSSSSSSSSSSSSSSST

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2196	2424	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2424	2840	rundll32.exe	30
PID 2840 wrote to memory of 2424	2840	rundll32.exe	30
PID 2840 wrote to memory of 2424	2840	rundll32.exe	30
PID 2840 wrote to memory of 2424	2840	rundll32.exe	30
PID 2840 wrote to memory of 2424	2840	rundll32.exe	30
PID 2840 wrote to memory of 2424	2840	rundll32.exe	30
PID 2840 wrote to memory of 2424	2840	rundll32.exe	30
PID 2424 wrote to memory of 2196	2424	rundll32.exe	31
PID 2424 wrote to memory of 2196	2424	rundll32.exe	31
PID 2424 wrote to memory of 2196	2424	rundll32.exe	31
PID 2424 wrote to memory of 2196	2424	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\astrct.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\astrct.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 252
    3⤵
    - Program crash
    PID:2196