94995b2d7b4973d6b4f03c6bd9b7b48380b695342b38ad2ca6556df6daa5edec

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-09-2024 16:02

Target

A Final Draft Bill of Lading/msvcp150.dll
Size

2.5MB
MD5

7b3d9df4c46050de65202618a45f05ec
SHA1

d1803ba62b00b43382b98800278768984c6a9b3d
SHA256

4578c2745086896f8edc605858de2a705ce05c41cc5fea8be244ad701224d345
SHA512

dc658905fd9670744a0f54912167f104ca7a8a22507afd746f89d85d3e9155aebddc1f14c14302bad00bb2e84363ca2bd44e809eee668ff74b1c3d86bfb6b11e
SSDEEP

24576:ZTonNo2uK0pGFY6y+K+Tj7dfE1SS0+yJLmdcxldgF0damjCtXhcfiZUde:UN4K0pk0mj7dEhyoMdgF0dr0ct

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 3000	1988	rundll32.exe	30
PID 1988 wrote to memory of 3000	1988	rundll32.exe	30
PID 1988 wrote to memory of 3000	1988	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\A Final Draft Bill of Lading\msvcp150.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1988 -s 204
  2⤵
  PID:3000