e68d23feaf21b116b0bdeb7c667f8fb547a58f53437dd9e3f9141b5afc6dddcd

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 15:07

Target

sfbrename-cli-1.0.0-win64/libpcre-1.dll
Size

275KB
MD5

a4e14b1f3042bfbf0b018561f8611d93
SHA1

5c4c26f66adcc1b40d7ff3113701fd9dca9f74e6
SHA256

624e1e55f227897eb6e5852d28f0448f25ade61a98894789fd45a3f8ae32d0ea
SHA512

da4d86df061948a37d513132686e91e13960fa28eb427bb841e0dacbf91564b3713de6ca5ee49d17c0e1b449c0252ef9f4e8c02205bf2169ca7d761dc3872802
SSDEEP

3072:uD/iPx3WGmBoVKxtW0qib30Mj/vYYoGtjGeIGA9R23m6+PiaAtB3NFUQ8:uTUGprc6HfIG86+adX3NFUQ8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2780	2716	rundll32.exe	30
PID 2716 wrote to memory of 2780	2716	rundll32.exe	30
PID 2716 wrote to memory of 2780	2716	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sfbrename-cli-1.0.0-win64\libpcre-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2716 -s 80
  2⤵
  PID:2780

memory/2716-0-0x000007FEFA580000-0x000007FEFA5CD000-memory.dmp

Filesize
308KB

Download