bb227aa7b0404ccac254372c91ddf2e307526aa82ed9c4ecd3e495c38a6b4552

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 08:31

Target

MedicareSign/libjpegturbowin.dll
Size

696KB
MD5

96d413caaf8c7793a96ef200f6695922
SHA1

abfb19a5bea8724a08a3c709b68c65178e8efbe5
SHA256

5c6e5346c4ef80e1dd211bd5519311aca01025ce1d3811113a03e657938f370d
SHA512

93bf7ac89ae64948c3e91294de89478b0f92d9cefb71c803abb324e181d783801c87dd6d806b0db0d3737b3330e37993ae07b9b7d5aacca9f9f5c3556e23eee4
SSDEEP

12288:RPCS0cSUktNimb/JZqNFcbJ3bZJNlvI8CjBMUC6eVc4/SK:RPCS0c1ktNimbqYZJNlvVc4L

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2756	2648	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2648	3004	rundll32.exe	30
PID 3004 wrote to memory of 2648	3004	rundll32.exe	30
PID 3004 wrote to memory of 2648	3004	rundll32.exe	30
PID 3004 wrote to memory of 2648	3004	rundll32.exe	30
PID 3004 wrote to memory of 2648	3004	rundll32.exe	30
PID 3004 wrote to memory of 2648	3004	rundll32.exe	30
PID 3004 wrote to memory of 2648	3004	rundll32.exe	30
PID 2648 wrote to memory of 2756	2648	rundll32.exe	31
PID 2648 wrote to memory of 2756	2648	rundll32.exe	31
PID 2648 wrote to memory of 2756	2648	rundll32.exe	31
PID 2648 wrote to memory of 2756	2648	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\libjpegturbowin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\libjpegturbowin.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 220
    3⤵
    - Program crash
    PID:2756