8eb6945907c07f04bcfd3d70dde85c2c6adafad1f5a11008df67882a5220f767

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 09:43

Target

__MACOS__/__MACOS__/__MACOS__/__MACOS__/__MACOS__/ipc_core.dll
Size

1.6MB
MD5

c1627423b5a38bd537fdae512d8d78a2
SHA1

59656dbfe2ab0e96a10c44212fca9bdf0ac2dec2
SHA256

a94b89c7ff7926ccead39defc57fb4c750d1a6f87e7c340a960bf79da30b297e
SHA512

e08cd4a0ff0a22fcc9bdbaf20e02769b874bcf4960ca35eccb4ac0bc97f33ff446b7d04a08c0293ca270f5b97c27993cfcba1c0691c1a994be0dff4fb29ce92d
SSDEEP

49152:ZAc57sG0h4r8Jzm/XuPTSAyYmC25SA1oKrsg+SBsg+SBNb4Z7d+:vj9/sAmguSBuSBNb4Z7d+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 288 wrote to memory of 2316	288	rundll32.exe	30
PID 288 wrote to memory of 2316	288	rundll32.exe	30
PID 288 wrote to memory of 2316	288	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\__MACOS__\__MACOS__\__MACOS__\__MACOS__\__MACOS__\ipc_core.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:288
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 288 -s 156
  2⤵
  PID:2316