f032591ff92ac9f36254adcab78f85d13f6c7559ecd0e7cb782d3c49db70ca1b

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 23:56

Target

nEO iMAGING/SiteList.dll
Size

87KB
MD5

548ea72e83a23f78d006bec92e180ee9
SHA1

314a2f1c72c89bc5e6c262b51a448586e75c7a4f
SHA256

04476e0e42c2cc198632376471de8b978064662bcd9ebec8bedce76fa6a9c4c0
SHA512

5c2a728eee9d6fb7242b0eaa5691deff6cb9d2256e33ea1612aca9343160af335166613a3562347b07dcb7d0ba5c706f8b49a4b04256d2d3cc7d76e31194219a
SSDEEP

1536:FaqKYQefKSi4a0ivL6KZhrWw4B8Ri+fxqHeNuqKIz7NDjLKQzaYE5BBgTiVpfZcq:KYhB3CLTZxWw4B8A+fxqHeNuqKIz7NDs

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2124	3068	WerFault.exe	31

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 3068	536	rundll32.exe	31
PID 536 wrote to memory of 3068	536	rundll32.exe	31
PID 536 wrote to memory of 3068	536	rundll32.exe	31
PID 536 wrote to memory of 3068	536	rundll32.exe	31
PID 536 wrote to memory of 3068	536	rundll32.exe	31
PID 536 wrote to memory of 3068	536	rundll32.exe	31
PID 536 wrote to memory of 3068	536	rundll32.exe	31
PID 3068 wrote to memory of 2124	3068	rundll32.exe	32
PID 3068 wrote to memory of 2124	3068	rundll32.exe	32
PID 3068 wrote to memory of 2124	3068	rundll32.exe	32
PID 3068 wrote to memory of 2124	3068	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\nEO iMAGING\SiteList.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\nEO iMAGING\SiteList.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 240
    3⤵
    - Program crash
    PID:2124

memory/3068-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3068-1-0x0000000000140000-0x000000000014B000-memory.dmp

Filesize
44KB

Download