7bc23223c8f81d70c230ceac3deb05670e9778974fd285b8cae1e693c2367de4

Analysis

max time kernel
14s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 12:15

Target
DontBearWithCheaters/xxhash.dll
Size 47KB
Sample240818-pfbgvswekr
SHA256 f291117a848583a74bd0546511715a293a9b87d4c2a250bf431f98f1bb20de6c
MD5 19081ff52c0c21e888c2795f42200215
SHA1 ef8528891c7250111cc3592baf162006f0607c7f
SHA512 cfaa8c1ea5145870b88ef0b299d67e6f902cadfbbbab03d6843e1e65bdebe37ba463b200041c64bb191c5f907d559c2df52756290031d33876a79665ef31d3e4
SSDEEP 768:D1WkmhW508rbV9uoF6QV8nBT+RYOsYeZbK9DSPItsrXzhqcqOMLOC:D1aW5BrbuHbnBiGO9SbTISXzhqcqOMa
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 2036	1944	rundll32.exe	29
PID 1944 wrote to memory of 2036	1944	rundll32.exe	29
PID 1944 wrote to memory of 2036	1944	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DontBearWithCheaters\xxhash.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1944 -s 84
  2⤵
  PID:2036