50218cd76716ccb1250f1a491cf26c883fdd18cd78b68c385649d3bbcf8c5cb9

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 03:31

Target

lib/libwebpdecoder.dll
Size

249KB
MD5

8a714d720f9b808891065cd9f4c2a02c
SHA1

970fa19e2ecacef44ec07dba164116f0ffbd9ec7
SHA256

5a9efa35813558be34e0d27d612f9a341055404bb1c63185632fefe83897432f
SHA512

603e6a7a663ba573a3580f446805ecae11adb15968a453e7079bfcb2720b56caf894f8d5c9158cdf6ec1e0d7699c09872c0cf25c9933cd155b523aa6717de663
SSDEEP

3072:zDwOaWxKhaL7D4/nYWBRAy1t5fmcVhzEvqtJS8rKlJb4HExWnQlzpM7VuLP3lj99:/wgEaLOnFYcVhO2rAXXe40pAe35

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 1648	2464	rundll32.exe	30
PID 2464 wrote to memory of 1648	2464	rundll32.exe	30
PID 2464 wrote to memory of 1648	2464	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\libwebpdecoder.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2464 -s 80
  2⤵
  PID:1648