ebc01204db28d3b78057ae195619aeab1a9c41859b72102d468d7a7c67468dcd

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 18:58

Target

resources/app.asar.unpacked/node_modules/btime/binding.dll
Size

118KB
MD5

13a2579ed95366185a6247c9e4b9f0cc
SHA1

61fef12da622484e44b3c9ddcd61706c9af00aa0
SHA256

98c51303c38dc03faeeba13f26fa3c6645d0c1a502b8a5d28177ce015dacf35f
SHA512

7aae5a45f5333355c81e4a7468d40c9d814a1b242c99a39747fea9b66e277dd1060bda290fc980e958beccab2ac0232fc4aba078426ac5ae39c19968ae8f58d0
SSDEEP

1536:OMwHUFyUCyB7KdX2teZOpSPtvdO+tYLZI2mAq+J6sWyd09dlgh7tBrdO6t2:hwjUCyB7eC8OpSS+tYLZI5+NMKFdO6t

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2132	1672	rundll32.exe	28
PID 1672 wrote to memory of 2132	1672	rundll32.exe	28
PID 1672 wrote to memory of 2132	1672	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\btime\binding.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1672 -s 156
  2⤵
  PID:2132