e68d23feaf21b116b0bdeb7c667f8fb547a58f53437dd9e3f9141b5afc6dddcd

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 15:07

Target

sfbrename-cli-1.0.0-win64/libgio-2.0-0.dll
Size

1.6MB
MD5

9dd97c9f0856987effac3cf7269bed67
SHA1

b70b41d4548480c650de4c820d9c0253557c5ba1
SHA256

fd23b1c0a85b0ba787ca8d208ffb91b9c5d404bd79059807b47f66c2e9b0e44c
SHA512

c6919b045fea101f1c69cbc774b4244697cf50cc8e6c4f750e7cad70b296dfb71c5ff9e01ee30cca18ba976b5cb4bf9fcbc685c06cf5ac3fb6260bb6f88897ed
SSDEEP

49152:OlcRZJ2NFbjU1ADe1Jf40Wmlax5GPswq+:MEljwmlI5GPswq+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2864	2700	rundll32.exe	30
PID 2700 wrote to memory of 2864	2700	rundll32.exe	30
PID 2700 wrote to memory of 2864	2700	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sfbrename-cli-1.0.0-win64\libgio-2.0-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2700 -s 264
  2⤵
  PID:2864

memory/2700-0-0x000007FEF62F0000-0x000007FEF6494000-memory.dmp

Filesize
1.6MB

Download
memory/2700-1-0x000007FEFAB80000-0x000007FEFABA8000-memory.dmp

Filesize
160KB

Download
memory/2700-3-0x000007FEF79E0000-0x000007FEF7A04000-memory.dmp

Filesize
144KB

Download
memory/2700-2-0x000007FEF6E10000-0x000007FEF6F29000-memory.dmp

Filesize
1.1MB

Download
memory/2700-8-0x000007FEFB870000-0x000007FEFB880000-memory.dmp

Filesize
64KB

Download
memory/2700-7-0x000007FEF6810000-0x000007FEF6867000-memory.dmp

Filesize
348KB

Download
memory/2700-6-0x000007FEFB880000-0x000007FEFB88F000-memory.dmp

Filesize
60KB

Download
memory/2700-5-0x000007FEF6DC0000-0x000007FEF6E0D000-memory.dmp

Filesize
308KB

Download
memory/2700-4-0x000007FEF6870000-0x000007FEF69BF000-memory.dmp

Filesize
1.3MB

Download