6f67637e29f8c046d7a6547edab6149247e74e53298086bf013d3d6332b1d095

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 01:50

Target

bin/libsoplexshared.dll
Size

4.3MB
MD5

400f508b5ca3c2bba3a8ba21500b5edf
SHA1

0e67c84d13ab4210f84528e3debcca4b36ce73ec
SHA256

8b5f940e3a5313ffa892eb225fe4d5d7ec116ef8685fae9f5344f37141c55ed0
SHA512

ccd1ac9ca410829c5608eb5b76129261c3527f001c4e30d632cc778bea54ee83cf6ff2d5b504c9a10137f058b53f09140a4ea2d0acb31eab0fd06a7e04ef3b13
SSDEEP

49152:lpAmiZ/VUUjXn8FzoWSAotTnNuZASOQE10a42K3qps9RChF/kUjJLh6GvR4yXmA8:lpjiZ/aMdRfBhpZ4

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 1648	2464	rundll32.exe	30
PID 2464 wrote to memory of 1648	2464	rundll32.exe	30
PID 2464 wrote to memory of 1648	2464	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\libsoplexshared.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2464 -s 80
  2⤵
  PID:1648