bb227aa7b0404ccac254372c91ddf2e307526aa82ed9c4ecd3e495c38a6b4552

Analysis

max time kernel
12s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 08:31

Target

MedicareSign/hatls.dll
Size

2.1MB
MD5

bccf6a5c2595eea84533692bb788d8bb
SHA1

24318226f145e52b7633a4e9e844d6ead43b75ac
SHA256

abf75de674428e112f90f1c618218ff73ef851f4f09c5f5ba8b69e79a6c74dbf
SHA512

78f24f0812aae31e83340adeb1a1ae8c00edfdf483e299706f863cb713bfdc2501b5418ce8f8bd9131e3c704bffb58a8ca05c5e0a75eb19f15e0409c5b74e35b
SSDEEP

24576:2HGHuX4EewGQcPryfFMoxJ+4PulW/ChEIgTS/zRUm:2HGOX4CGQtMs+WuVge/em

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3056	1052	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 1052	2508	rundll32.exe	29
PID 2508 wrote to memory of 1052	2508	rundll32.exe	29
PID 2508 wrote to memory of 1052	2508	rundll32.exe	29
PID 2508 wrote to memory of 1052	2508	rundll32.exe	29
PID 2508 wrote to memory of 1052	2508	rundll32.exe	29
PID 2508 wrote to memory of 1052	2508	rundll32.exe	29
PID 2508 wrote to memory of 1052	2508	rundll32.exe	29
PID 1052 wrote to memory of 3056	1052	rundll32.exe	30
PID 1052 wrote to memory of 3056	1052	rundll32.exe	30
PID 1052 wrote to memory of 3056	1052	rundll32.exe	30
PID 1052 wrote to memory of 3056	1052	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\hatls.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\hatls.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 224
    3⤵
    - Program crash
    PID:3056

memory/1052-0-0x0000000074380000-0x000000007466E000-memory.dmp

Filesize
2.9MB

Download
memory/1052-1-0x0000000074090000-0x000000007437E000-memory.dmp

Filesize
2.9MB

Download
memory/1052-2-0x0000000074380000-0x000000007466E000-memory.dmp

Filesize
2.9MB

Download