cf44f5c1dc5bfccb23436149f3de5f4292fc141a9ec7f5349c5e31b2b483c176

Analysis

max time kernel
14s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 11:52

Target

x64/leptonica-1.82.0.dll
Size

3.9MB
MD5

497e0275a17d6524542fd4191bbadeea
SHA1

c7cc2a6f38391680bffa67588829802efef4c7d4
SHA256

a477273302efc8ad7f82fc3c0d33f54626a26a66e933d03699cd921aa35ff012
SHA512

91876dbd7cd42c7fa740d508d6fb7ad0d31bde6524fe4d474d3662ddf4bcab2742d8c27482a6b6c220f3bc7d10189f91b0ce6711723adf753f788fd705636749
SSDEEP

49152:mswZaNhoxIIoJ2YQ8km8I72iHWj1nbH8n2akRhd0VtXOBxYd5NNNT/Q8mI7G2U5W:ph8p1bHAuYd/NNTJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 3028	2248	rundll32.exe	30
PID 2248 wrote to memory of 3028	2248	rundll32.exe	30
PID 2248 wrote to memory of 3028	2248	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x64\leptonica-1.82.0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2248 -s 80
  2⤵
  PID:3028