e68d23feaf21b116b0bdeb7c667f8fb547a58f53437dd9e3f9141b5afc6dddcd

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 15:07

Target

sfbrename-cli-1.0.0-win64/libffi-7.dll
Size

29KB
MD5

43c639b6ba8415f94b8fc27a96042650
SHA1

07ed717e5032f2025f759ef484fc25178922768c
SHA256

d07afee9199e6cbf406f7e6a7f9673296bda5244e5ca79a37177226f12801d35
SHA512

eeadc1f19a633ab2b05c4466de6d35cfb7c76a731d8ac23e5cbf7005ed905874c43bfc6f5da9aeeab66aad00584862df691e7ae8e5da805ee1d9608cb6663b0d
SSDEEP

384:PC9/Hckzur4W7phM9EsXbD37e9t8TlfJJD+QiUZ5ZqtIsNYF5VYJO0mnwrRCXWxU:q9UkeXMNXbD37e9LUZfqtkLVYJXuWc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2976	2360	rundll32.exe	31
PID 2360 wrote to memory of 2976	2360	rundll32.exe	31
PID 2360 wrote to memory of 2976	2360	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sfbrename-cli-1.0.0-win64\libffi-7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2360 -s 80
  2⤵
  PID:2976

memory/2360-0-0x000007FEFC3D0000-0x000007FEFC3E0000-memory.dmp

Filesize
64KB

Download