ebc01204db28d3b78057ae195619aeab1a9c41859b72102d468d7a7c67468dcd

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 18:58

Target

resources/app.asar.unpacked/node_modules/get-fonts/binding.dll
Size

125KB
MD5

eeb1d1ea9fc3f870f292161cfa79850d
SHA1

ea4f4324245f9f4d6280ef285151f688221d6023
SHA256

149bc3824ecbf68f7a892a311e77548ea156963b88db0590063b50725c9d883c
SHA512

795269fba2737ca51d61bb0f6e674c8ed45f2590a48d1dbc53adae9a85b5565e372de6e2a888f038660173f6f4fe0ecda293c441415296e79097c261c452f254
SSDEEP

3072:cd5+N3E2MosoJCakr0dHPAMMMtrAfz9MrRAG:yIxMQQakr0xPSfzirqG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2060	2644	rundll32.exe	31
PID 2644 wrote to memory of 2060	2644	rundll32.exe	31
PID 2644 wrote to memory of 2060	2644	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\get-fonts\binding.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2644 -s 156
  2⤵
  PID:2060