e68d23feaf21b116b0bdeb7c667f8fb547a58f53437dd9e3f9141b5afc6dddcd

Analysis

max time kernel
140s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 15:07

Target

sfbrename-cli-1.0.0-win64/libiconv-2.dll
Size

1.1MB
MD5

0c638f8d0cf9aece8ac9177ab5497ce4
SHA1

ff98497b4516663f2c91035765cae5efb1e38160
SHA256

1728ee90659f887ae52f977f2c57684c1ec81ac84caddb1186281fbb85e14390
SHA512

ced03f1ce0a0b0aff5fa8f7160d009f3e1ffda4e4f45c23a837bb3c95b77ebc0658d39b98423a5e67c066d66a8eb5e99d63effd4f8692600fd27e8e51a28161d
SSDEEP

24576:PhBAUZLY3wPKo6VbbTiZGavkg3NyeuQ6l9fH+f0Fu:JBAUZLYgio6EZGaXBuQQ9e0Fu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 1320	2148	rundll32.exe	30
PID 2148 wrote to memory of 1320	2148	rundll32.exe	30
PID 2148 wrote to memory of 1320	2148	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sfbrename-cli-1.0.0-win64\libiconv-2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2148 -s 80
  2⤵
  PID:1320

memory/2148-0-0x000007FEF5AF0000-0x000007FEF5C09000-memory.dmp

Filesize
1.1MB

Download