6d7a257e34261f8c88e355658881a50a056f8600e2e57ac0b24647a35143e1d2

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 01:35

Target

__MACOS__/__MACOS__/__MACOS__/__MACOS__/__MACOS__/ipc_core.dll
Size

1.6MB
MD5

c1627423b5a38bd537fdae512d8d78a2
SHA1

59656dbfe2ab0e96a10c44212fca9bdf0ac2dec2
SHA256

a94b89c7ff7926ccead39defc57fb4c750d1a6f87e7c340a960bf79da30b297e
SHA512

e08cd4a0ff0a22fcc9bdbaf20e02769b874bcf4960ca35eccb4ac0bc97f33ff446b7d04a08c0293ca270f5b97c27993cfcba1c0691c1a994be0dff4fb29ce92d
SSDEEP

49152:ZAc57sG0h4r8Jzm/XuPTSAyYmC25SA1oKrsg+SBsg+SBNb4Z7d+:vj9/sAmguSBuSBNb4Z7d+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2416	2104	rundll32.exe	30
PID 2104 wrote to memory of 2416	2104	rundll32.exe	30
PID 2104 wrote to memory of 2416	2104	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\__MACOS__\__MACOS__\__MACOS__\__MACOS__\__MACOS__\ipc_core.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2104 -s 156
  2⤵
  PID:2416