81e45c1e6d6a718624159e116e6daa8c1547f39bef7f56163303e7eca8abfae1

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29-09-2024 14:21

Target

Resource/Sausage Fattener 64.dll
Size

745KB
MD5

54796ccdb2d6031b2e0d1259e534caac
SHA1

5c46b4ee988900a2da2a0a60314ac45ac265c9ef
SHA256

59b707eefe8286a9468d8ddb4cab4fc5ad4090ef21d68f4c57a3da2c9a5df58d
SHA512

d3fc2c18f431bb7a7aa08ebc70026409363700bc509c22e53d12e14e480fb9096cb0e583cead0e882ebeb21c1b29e7655d86bad65a041b27c377404fe41c186a
SSDEEP

6144:B12aJOgYCwbtc6bZ7e7c30XnmT/0Vn3wTpyw4156CM5uG7t6q5bAy2WGvy+Vv1nC:5kgob6QZJ0Xnq/3N5uG7eyDcFbA8oKo

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 3044	2648	rundll32.exe	30
PID 2648 wrote to memory of 3044	2648	rundll32.exe	30
PID 2648 wrote to memory of 3044	2648	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Resource\Sausage Fattener 64.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2648 -s 172
  2⤵
  PID:3044