50218cd76716ccb1250f1a491cf26c883fdd18cd78b68c385649d3bbcf8c5cb9

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 03:31

Target

lib/libglib-2.0-0.dll
Size

1.4MB
MD5

5aa5bd73bf50a34ba5da4fc516575459
SHA1

021fc405ea9cd0486e6244c6906f30446e96a9b0
SHA256

1c8027b5eda4fcefdfb7f28f5d2c33b3731c273cd161a6a6e435b25c6dde9e8d
SHA512

11b7881a00fde3259c47c67758d9e9a9776ff95e8ec8539655a8f34153e1b7c8b0a7261e4c2fdb2e52181859d35ee480d6711528a5b266235ca4e9ceb52f765a
SSDEEP

24576:Ojbp3cn8ldnOwfm0Q9AbxkVxLe0rhC3rSiXkXAHb/ISglYg1xwbdFIvA2+qFSChn:Ojbp3cGdnOwfaabxkVxLe0rg3rLXkwHE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2124	2536	rundll32.exe	31
PID 2536 wrote to memory of 2124	2536	rundll32.exe	31
PID 2536 wrote to memory of 2124	2536	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\libglib-2.0-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2536 -s 148
  2⤵
  PID:2124

memory/2536-2-0x0000000070CC0000-0x0000000070CCD000-memory.dmp

Filesize
52KB

Download
memory/2536-1-0x0000000070A40000-0x0000000070AC9000-memory.dmp

Filesize
548KB

Download
memory/2536-0-0x0000000061F80000-0x00000000620F4000-memory.dmp

Filesize
1.5MB

Download