b0f676f29e958a2b569442e554b8798dd0f74cbe6379c3ef8e95e7320ab54606

Analysis

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 06:08

Target

Electric Shock Academy/baselib.dll
Size

395KB
MD5

683b24a85cc8aa1a2e198b8339b90e4b
SHA1

4d64e584f3475d65d67c6430cf71973b9bc2326f
SHA256

8e27a7f47f6a73677d64fca5717fd733e661649fd67bec0474d01da535a9a935
SHA512

9f185166feaca6236e2379c50ce54c16ca162f25ceb26988a948b1260fe231d11daa390ab2a5bce267f30c83a12dc1f38aa725a2ab7f99ae3758c301b358c996
SSDEEP

6144:4mLYaM15dNBJ69tUpFxE3qj4fW1Uyy5Um7vn78sdTW4FwVXpQkp4o3FCe:/Ya8P2UiWeyogGdeIe

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2104	2820	rundll32.exe	30
PID 2820 wrote to memory of 2104	2820	rundll32.exe	30
PID 2820 wrote to memory of 2104	2820	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Electric Shock Academy\baselib.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2820 -s 80
  2⤵
  PID:2104