f032591ff92ac9f36254adcab78f85d13f6c7559ecd0e7cb782d3c49db70ca1b

Analysis

max time kernel
142s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 23:56

Target

nEO iMAGING/borlndmm.dll
Size

22KB
MD5

232966bf4e5f15491481ac3958131a21
SHA1

3a8f6cc882e354dca5c1a570faeaad7ebe6adf00
SHA256

8af7c734698d544bff3985c973acd680cc4eeca4dc69b3b87f6a177e3aae3abe
SHA512

4845d41979116cfaf4bcf7e7c6005cb0f4082eb3f6fc45468a8504bd08df0ec2ac59f4d547b84d4c7e0602a064b689438dbe6caba73990e3333af49cad6f95cb
SSDEEP

384:ct9kMq7qiRQW9UzLs91i45ZWpDahlzuIqo0EzrEKAz+vw7:fMq7qOQWWzIhI+hYIqvE3Ez+c

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3064	3068	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 3068	3012	rundll32.exe	29
PID 3012 wrote to memory of 3068	3012	rundll32.exe	29
PID 3012 wrote to memory of 3068	3012	rundll32.exe	29
PID 3012 wrote to memory of 3068	3012	rundll32.exe	29
PID 3012 wrote to memory of 3068	3012	rundll32.exe	29
PID 3012 wrote to memory of 3068	3012	rundll32.exe	29
PID 3012 wrote to memory of 3068	3012	rundll32.exe	29
PID 3068 wrote to memory of 3064	3068	rundll32.exe	30
PID 3068 wrote to memory of 3064	3068	rundll32.exe	30
PID 3068 wrote to memory of 3064	3068	rundll32.exe	30
PID 3068 wrote to memory of 3064	3068	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\nEO iMAGING\borlndmm.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\nEO iMAGING\borlndmm.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 228
    3⤵
    - Program crash
    PID:3064

memory/3068-0-0x0000000000D20000-0x0000000000D2B000-memory.dmp

Filesize
44KB

Download