1a92dbc49c1256cd2b338e3098fb4028862d74205ecd9903ca016f6b284b86e8

Analysis

max time kernel
1s
max time network
23s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 06:33

Target

Mating Season_Data/Plugins/x86_64/lib_burst_generated.dll
Size

260KB
MD5

52f73c97d68bc692227408afd9c6f60e
SHA1

027d9d40b7eb74281b6176ddaf47e7dc0e100c0e
SHA256

2e6718f1c741647a2c6584d199b062938158bd5afe2db0f6d8afe13efbf5def3
SHA512

38f8a9d0fb5391ada2af4742075d022dfc4ecb809a1ce75f9ee999c84f4a406dce490b3cc0b7d52cd74dfdeb23323fbc959cd7baabcbe18b8057c6f303fb01c9
SSDEEP

3072:aGxTK1yLnEJ3rpYuYjmCHk0q2gj26ky4wgQi9h+LQ1Ly:aJ1UApYuZ0uj2HyqQiiLQV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2360	2604	rundll32.exe	30
PID 2604 wrote to memory of 2360	2604	rundll32.exe	30
PID 2604 wrote to memory of 2360	2604	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Mating Season_Data\Plugins\x86_64\lib_burst_generated.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2604 -s 80
  2⤵
  PID:2360