6d7a257e34261f8c88e355658881a50a056f8600e2e57ac0b24647a35143e1d2

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 01:35

Target

__MACOS__/__MACOS__/__MACOS__/__MACOS__/__MACOS__/help.dll
Size

125KB
MD5

066b14b6a795a758bce107b5f3576d58
SHA1

42e3934856329ed58b28106ef3a69609b4fb8271
SHA256

46d3eef767d35b7e04eeefafb6787e5dec4ed413c9548c4d7e27c18cfe8c6b06
SHA512

461b68a1c0c8772d41f37b3fb38a8090cd7bc2c0e13544dd713161385cdd5020e506afd480d63a3b468630445a0036579a8bec8f9c9f6422b1531767baa1b0b5
SSDEEP

3072:Wferm6Yo4IepsJnCSfWmTBfqP1QrFpNXj3lb:WfeytIeulCSjTBiP1Q5pNJb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 2560	1528	rundll32.exe	30
PID 1528 wrote to memory of 2560	1528	rundll32.exe	30
PID 1528 wrote to memory of 2560	1528	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\__MACOS__\__MACOS__\__MACOS__\__MACOS__\__MACOS__\help.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1528 -s 80
  2⤵
  PID:2560