d06e9ce775bede2bc7c71b02ea389080b874ec408268edf1b5ef6d6fe7de0dde

Analysis

max time kernel
85s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/09/2024, 08:33

Target
bink2w64.dll
Size 417KB
Sample240915-kf2a3avfkn
SHA256 0e19736e87202938d565f1471d0820979a95282c24a0a2b8b81c94a3599cd56b
MD5 e36959ce05a81e732ea81f6c5a010a2d
SHA1 02bdfaa1aecf85761c354b3a13f48e38b0de887a
SHA512 1a59d132d9ba39beeefa2a88177fa78787599f0c74123a5f5e73ce479f0f3161b85b174fe194753f3ee55bf96cae5d0016ed0975eeb5b84c1a7cd87480656212
SSDEEP 6144:jxVfNyeVD93sL8oWyxMq+gFNn47b5mMkkj3wzk6Mi/PuKshrYULi7N7dcHQYSkD6:NV93/oWy9+gF4kkb5CshrjJ962L+R
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2300	1984	rundll32.exe	31
PID 1984 wrote to memory of 2300	1984	rundll32.exe	31
PID 1984 wrote to memory of 2300	1984	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bink2w64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1984 -s 120
  2⤵
  PID:2300