910bc0e0e5afd7669cfd1932606e30484751c5cd8de63d37a39716bc039c5317

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 17:11

Target

setup-x86_64/Cryptodome/Cipher/_raw_ctr.dll
Size

14KB
MD5

c6d62b2f36eeb323aff19b6aad67e8e7
SHA1

b511de60a528847ae4203d3e0fc2a2fb713167b3
SHA256

dc4b1435d43fa8b589a04f14b3e30085703b4b7ea6db2e4d2d656b822ebc6133
SHA512

e8e09059747cf88571f1e75cbd0ee555768fcf5f088983e8e1ae0f59506471e9784235d5d28057eeaa6df7d972934add6fc410af1af2d49d6f871950db2419d6
SSDEEP

192:WJ1gSPqgKkwv0i8NSixSK57NEEE/qexcEtDryDjRcqgUF6+6vEX:WE1si8NSixS0CqebtDargUUjvE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2396	2372	rundll32.exe	30
PID 2372 wrote to memory of 2396	2372	rundll32.exe	30
PID 2372 wrote to memory of 2396	2372	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\setup-x86_64\Cryptodome\Cipher\_raw_ctr.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2372 -s 80
  2⤵
  PID:2396