8eb6945907c07f04bcfd3d70dde85c2c6adafad1f5a11008df67882a5220f767

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 09:43

Target

__MACOS__/__MACOS__/__MACOS__/__MACOS__/__MACOS__/help.dll
Size

125KB
MD5

066b14b6a795a758bce107b5f3576d58
SHA1

42e3934856329ed58b28106ef3a69609b4fb8271
SHA256

46d3eef767d35b7e04eeefafb6787e5dec4ed413c9548c4d7e27c18cfe8c6b06
SHA512

461b68a1c0c8772d41f37b3fb38a8090cd7bc2c0e13544dd713161385cdd5020e506afd480d63a3b468630445a0036579a8bec8f9c9f6422b1531767baa1b0b5
SSDEEP

3072:Wferm6Yo4IepsJnCSfWmTBfqP1QrFpNXj3lb:WfeytIeulCSjTBiP1Q5pNJb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 3060	3012	rundll32.exe	29
PID 3012 wrote to memory of 3060	3012	rundll32.exe	29
PID 3012 wrote to memory of 3060	3012	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\__MACOS__\__MACOS__\__MACOS__\__MACOS__\__MACOS__\help.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3012 -s 84
  2⤵
  PID:3060