3da951c56a2b1a30bc04ab13d354d0790f97bfdb336e481e7f9af3d165ffdeb3

Analysis

max time kernel
140s
max time network
130s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 00:00

Target

DgAIModules.dll
Size

34.7MB
MD5

83a9fddcba5eb7ade96f32ca7d82f975
SHA1

a60f95ac91bacd05842031b4b5c32fad12030b8d
SHA256

4c8be80d62842de5a24545000c7a30d6bf474ba76fff407da1810892d958dc68
SHA512

93496f8b5bf6f6e4d4adc6100e8119d1df5e002172a4e948b21100a16b840bd842cc055ea0861af8ab2110ec1fa53217df34905e32916b40b9ebe1a7bcfc47e2
SSDEEP

393216:CTDMOmlY947OQTMGkVVkD2om3a16Tt9cLiAUG:XY9dQTrkVVkVm3a0h2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2292	3028	rundll32.exe	31
PID 3028 wrote to memory of 2292	3028	rundll32.exe	31
PID 3028 wrote to memory of 2292	3028	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DgAIModules.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3028 -s 292
  2⤵
  PID:2292

memory/3028-2-0x000007FEFA5F0000-0x000007FEFA63A000-memory.dmp

Filesize
296KB

Download
memory/3028-3-0x000007FEFA5C0000-0x000007FEFA5E4000-memory.dmp

Filesize
144KB

Download
memory/3028-0-0x000007FEF5EC0000-0x000007FEF60CD000-memory.dmp

Filesize
2.1MB

Download
memory/3028-1-0x000007FEFB070000-0x000007FEFB086000-memory.dmp

Filesize
88KB

Download
memory/3028-5-0x000007FEF67A0000-0x000007FEF6846000-memory.dmp

Filesize
664KB

Download
memory/3028-4-0x000007FEF5A20000-0x000007FEF5C4E000-memory.dmp

Filesize
2.2MB

Download