bb227aa7b0404ccac254372c91ddf2e307526aa82ed9c4ecd3e495c38a6b4552

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 08:31

Target

MedicareSign/libcryptoMD.dll
Size

2.0MB
MD5

1afc9bd5e625e85b696141f62fba4325
SHA1

56fb325125f436d7408808446d58af50f8aa3bfc
SHA256

83a1e3cbe242b978b9f55273b7b2648d0492b741ff561c0ec1c6ad9a4aedab47
SHA512

02c2cf9dbc319c2aaf324175cfd3e435824439f33b4ca697324f1b8ff4331d7bde80de46909fc629193ef02deb40853e295b35dc2e3b094d116b5dd783919213
SSDEEP

49152:Vkv4EyvQ/qpyr0kAYdQqqW6qvHewDe01CPwDv3uFR0b5YrpsJ:VkvXyvQ/qpyr0kAd66oewv1CPwDv3uFI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2168	2172	WerFault.exe	31

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2172	2324	rundll32.exe	31
PID 2324 wrote to memory of 2172	2324	rundll32.exe	31
PID 2324 wrote to memory of 2172	2324	rundll32.exe	31
PID 2324 wrote to memory of 2172	2324	rundll32.exe	31
PID 2324 wrote to memory of 2172	2324	rundll32.exe	31
PID 2324 wrote to memory of 2172	2324	rundll32.exe	31
PID 2324 wrote to memory of 2172	2324	rundll32.exe	31
PID 2172 wrote to memory of 2168	2172	rundll32.exe	32
PID 2172 wrote to memory of 2168	2172	rundll32.exe	32
PID 2172 wrote to memory of 2168	2172	rundll32.exe	32
PID 2172 wrote to memory of 2168	2172	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\libcryptoMD.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\libcryptoMD.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 220
    3⤵
    - Program crash
    PID:2168