34e141c88f20dffe25bf118a427415ce55cbc123848a2f6d2d5ccfe390a746ec

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 17:22

Target

Wave/CrackedWave/bin/wolfssl.dll
Size

1.2MB
MD5

a396ee8375252d04da31676fe1b3ff75
SHA1

57aee1e5b69a85d0e0b7d5a103ddb683f0204cce
SHA256

7dc3aeda7518abb376a6932583669e7e1595a656edeae65af1397807322e8a25
SHA512

ff755bed789869a8cc2adc05b7a3b234ef93997b1774cc719d506ce4dd03fcd0ed6d320a13d815e27a21ebdf99f3308ea47a8de6b9a25ca4eaa8fb4045fbb0db
SSDEEP

24576:yoCqsxtqSepCBr5fFrHodqht+tmiw9P9TsdJRV5Wodh8NHmoz:3CzASep0r5fFrHoUht+tU9TsrRV5WodE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 2112	1868	rundll32.exe	30
PID 1868 wrote to memory of 2112	1868	rundll32.exe	30
PID 1868 wrote to memory of 2112	1868	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Wave\CrackedWave\bin\wolfssl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1868 -s 92
  2⤵
  PID:2112