910bc0e0e5afd7669cfd1932606e30484751c5cd8de63d37a39716bc039c5317

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 17:11

Target

setup-x86_64/Cryptodome/Hash/_MD5.dll
Size

15KB
MD5

f4b238bffc04d34ff9fb509141f58b52
SHA1

7bf15ad20c48e5f4960a5d3bfad5e83d08b1114a
SHA256

90d27d5ffffaa94d1d01e23fc90ff657ab44d632dc595c7c17e8b7b94152f3e6
SHA512

b5a61b0253d91bea1dd7d16e7c6c059040f556021a03397cc940fe0c1273f1c5003ceca9cced03a9a189613b84404e6341f6f9591d2b2e8716360f2cffb8a9da
SSDEEP

192:1Z9WfqP7M93g8UdsoS1hhiBvzcuiDSjeoGmDZFRBP0rcqgjPrvE:oA0gHdzS1MwuiDSyoGmDbr89gjPrvE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2592	3004	rundll32.exe	31
PID 3004 wrote to memory of 2592	3004	rundll32.exe	31
PID 3004 wrote to memory of 2592	3004	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\setup-x86_64\Cryptodome\Hash\_MD5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3004 -s 80
  2⤵
  PID:2592