4af97f359c0001cb6ff0ec2eb8c2893a9e8c96134e026fa35b0f04bbc299a7f9

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
05/08/2024, 21:31

Target

S0laradD/locales/resources/app.asar.unpacked/node_modules/get-fonts/binding.dll
Size

125KB
MD5

eeb1d1ea9fc3f870f292161cfa79850d
SHA1

ea4f4324245f9f4d6280ef285151f688221d6023
SHA256

149bc3824ecbf68f7a892a311e77548ea156963b88db0590063b50725c9d883c
SHA512

795269fba2737ca51d61bb0f6e674c8ed45f2590a48d1dbc53adae9a85b5565e372de6e2a888f038660173f6f4fe0ecda293c441415296e79097c261c452f254
SSDEEP

3072:cd5+N3E2MosoJCakr0dHPAMMMtrAfz9MrRAG:yIxMQQakr0xPSfzirqG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2748	2668	rundll32.exe	30
PID 2668 wrote to memory of 2748	2668	rundll32.exe	30
PID 2668 wrote to memory of 2748	2668	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\S0laradD\locales\resources\app.asar.unpacked\node_modules\get-fonts\binding.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2668 -s 156
  2⤵
  PID:2748