e68d23feaf21b116b0bdeb7c667f8fb547a58f53437dd9e3f9141b5afc6dddcd

Analysis

max time kernel
141s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 15:07

Target

sfbrename-cli-1.0.0-win64/libglib-2.0-0.dll
Size

1.3MB
MD5

ffba5531716aeb7cb09e554b2c38d1e1
SHA1

fa4479f73f1fdd3d00d27c328f5ff5111b7a8d8d
SHA256

82718e98be997af93ab514d68a10bb6f902888133d2a756ca639e07d637bff38
SHA512

9c1a245bbea242d19dd00db9cc03acdfaa92d8c295d21d90fee2f5903d1db484e6a5a2ca5d23400ff9d98f1b8ee12cc74e9db39603e208e9771e2c5e80f60de6
SSDEEP

24576:t61WpmxoXnz5nxVvSHM7YBR+EBIp28NLtvXfhZW33Kd:tqWpm2z5nxlyM7YBRnB1utv5ZWnKd

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 2748	1076	rundll32.exe	30
PID 1076 wrote to memory of 2748	1076	rundll32.exe	30
PID 1076 wrote to memory of 2748	1076	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sfbrename-cli-1.0.0-win64\libglib-2.0-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1076 -s 148
  2⤵
  PID:2748

memory/1076-1-0x000007FEFA810000-0x000007FEFA838000-memory.dmp

Filesize
160KB

Download
memory/1076-3-0x000007FEFA750000-0x000007FEFA79D000-memory.dmp

Filesize
308KB

Download
memory/1076-2-0x000007FEF7150000-0x000007FEF7269000-memory.dmp

Filesize
1.1MB

Download
memory/1076-0-0x000007FEF6FD0000-0x000007FEF711F000-memory.dmp

Filesize
1.3MB

Download