f032591ff92ac9f36254adcab78f85d13f6c7559ecd0e7cb782d3c49db70ca1b

Analysis

max time kernel
11s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 23:56

Target

nEO iMAGING/easysnap.dll
Size

148KB
MD5

000300649d8cfd9c7d71d1b10a9bec03
SHA1

f1150afb173d8ceb40ee38e6ae634e6ec7c218f5
SHA256

f1084b70625ba7f4e626087d2319a4022c1990ddcf5d6c47c65ac2218841a433
SHA512

9c1d27ea980c1af87c6219d05e80508a02ab378a4ee8c9f99054baa4d4e705e77445e873375f49547a2cd6efb261b43e866a1557f364bf20ac9b3c7918968501
SSDEEP

1536:gvdbXWA+37Wgu6up7V/aRui0z5jq7nWyyrj2R+2Gm/j1c1w51vtmgMbFuZ0tfH5p:eGUgRu+Ofm5c1w5FAg0FuGtfHX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2476	2456	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 2456	1164	rundll32.exe	29
PID 1164 wrote to memory of 2456	1164	rundll32.exe	29
PID 1164 wrote to memory of 2456	1164	rundll32.exe	29
PID 1164 wrote to memory of 2456	1164	rundll32.exe	29
PID 1164 wrote to memory of 2456	1164	rundll32.exe	29
PID 1164 wrote to memory of 2456	1164	rundll32.exe	29
PID 1164 wrote to memory of 2456	1164	rundll32.exe	29
PID 2456 wrote to memory of 2476	2456	rundll32.exe	30
PID 2456 wrote to memory of 2476	2456	rundll32.exe	30
PID 2456 wrote to memory of 2476	2456	rundll32.exe	30
PID 2456 wrote to memory of 2476	2456	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\nEO iMAGING\easysnap.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\nEO iMAGING\easysnap.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 228
    3⤵
    - Program crash
    PID:2476