67edf175321f92df454c58fc64babaf1905a2843b0fe7105a3d5c6146c0e9898

Resubmissions

26/07/2024, 09:06

20/06/2024, 20:05

max time kernel
14s
max time network
17s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 09:06

Target

GlobalProtect64/jre/bin/w2k_lsa_auth.dll
Size

27KB
MD5

6c0f8ac6829c84371b327665b3004ff5
SHA1

59c66b5ae7686bf0683273e7b11f8ef70b5e54ae
SHA256

f592de140e4db0469620270f37748aefea283ed424ca0cf3eb40eb0a3af09618
SHA512

56222eeae1a724cfd11ca0c597252a41e0a42487719a640d19e652deac36a86891fbc61083f94d073d36dedb2e38d482be995632b19cb350b80d774aed8c4461
SSDEEP

768:sbHCk14I6I3g9NoZTU35QUOHkbGGGGNET7T7T7T7lWa/CN7MADGghSu:Z64I6I3g9NoZTU35QUOHkbGGGGNET7Tq

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 764	2872	rundll32.exe	28
PID 2872 wrote to memory of 764	2872	rundll32.exe	28
PID 2872 wrote to memory of 764	2872	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GlobalProtect64\jre\bin\w2k_lsa_auth.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2872 -s 96
  2⤵
  PID:764