bb227aa7b0404ccac254372c91ddf2e307526aa82ed9c4ecd3e495c38a6b4552

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 08:31

Target

MedicareSign/libjpegturbowin.dll
Size

696KB
MD5

96d413caaf8c7793a96ef200f6695922
SHA1

abfb19a5bea8724a08a3c709b68c65178e8efbe5
SHA256

5c6e5346c4ef80e1dd211bd5519311aca01025ce1d3811113a03e657938f370d
SHA512

93bf7ac89ae64948c3e91294de89478b0f92d9cefb71c803abb324e181d783801c87dd6d806b0db0d3737b3330e37993ae07b9b7d5aacca9f9f5c3556e23eee4
SSDEEP

12288:RPCS0cSUktNimb/JZqNFcbJ3bZJNlvI8CjBMUC6eVc4/SK:RPCS0c1ktNimbqYZJNlvVc4L

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3008	2232	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 2232	3548	rundll32.exe	84
PID 3548 wrote to memory of 2232	3548	rundll32.exe	84
PID 3548 wrote to memory of 2232	3548	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\libjpegturbowin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\libjpegturbowin.dll,#1
  2⤵
  PID:2232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 600
    3⤵
    - Program crash
    PID:3008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2232 -ip 2232
1⤵
PID:2288