4bf1ea8ace7f1c427b54adc6c8d9da2f79f5be1475e3ca4609e997e2b93f5e87

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 17:26

Target

slinky/slinkyhook.dll
Size

228KB
MD5

6d8c17c67970cb5841811eed8adffffc
SHA1

c869ab32318a035e51aff8e5e11b4cd25fb52a4f
SHA256

7c4234fac3b6b3e96dace1e71c7a952ec67e3839f90f7a88a9ea283bf88d25b8
SHA512

7d2a0ffcd72c8bf4a96b2ed722d7119749ec14f5d7e6a601cb6ae4a5b1c4a652b694158f01da340e3ca4751cabd0a56c42bf739d8b421e36937f3691b3b80c72
SSDEEP

3072:hXxN1I6PgabbAzVxPLI5oIa5amK/1o4ptgELHY1lNyc+m+e7P26g66OVuknsDe0u:hhN1GFZq/15tFc+m97ieuknsDu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2112 wrote to memory of 2404	2112	rundll32.exe	WerFault.exe
PID 2112 wrote to memory of 2404	2112	rundll32.exe	WerFault.exe
PID 2112 wrote to memory of 2404	2112	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\slinky\slinkyhook.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2112

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2112 -s 160
2⤵
PID:2404