f032591ff92ac9f36254adcab78f85d13f6c7559ecd0e7cb782d3c49db70ca1b

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 23:56

Target

nEO iMAGING/SiteList.dll
Size

87KB
MD5

548ea72e83a23f78d006bec92e180ee9
SHA1

314a2f1c72c89bc5e6c262b51a448586e75c7a4f
SHA256

04476e0e42c2cc198632376471de8b978064662bcd9ebec8bedce76fa6a9c4c0
SHA512

5c2a728eee9d6fb7242b0eaa5691deff6cb9d2256e33ea1612aca9343160af335166613a3562347b07dcb7d0ba5c706f8b49a4b04256d2d3cc7d76e31194219a
SSDEEP

1536:FaqKYQefKSi4a0ivL6KZhrWw4B8Ri+fxqHeNuqKIz7NDjLKQzaYE5BBgTiVpfZcq:KYhB3CLTZxWw4B8A+fxqHeNuqKIz7NDs

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2428	2640	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2640	2136	rundll32.exe	86
PID 2136 wrote to memory of 2640	2136	rundll32.exe	86
PID 2136 wrote to memory of 2640	2136	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\nEO iMAGING\SiteList.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\nEO iMAGING\SiteList.dll",#1
  2⤵
  PID:2640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 632
    3⤵
    - Program crash
    PID:2428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2640 -ip 2640
1⤵
PID:3600

memory/2640-1-0x0000000000BF0000-0x0000000000BFB000-memory.dmp

Filesize
44KB

Download
memory/2640-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download