910bc0e0e5afd7669cfd1932606e30484751c5cd8de63d37a39716bc039c5317

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 17:11

Target

setup-x86_64/Cryptodome/Cipher/_raw_cfb.dll
Size

13KB
MD5

f5998840565b2446efe4522235ebcf74
SHA1

fd4f3d9e902b9a6e1d9107aab9668454ae83ec55
SHA256

10b5ade34be7c513cdb0c1d375e37e3a0de99494732eba81fda4e69cae678e9f
SHA512

d80b29cdc9766ea5bf25d7ef9c72371e63bf1e0662b759efbe434583db95ccffa3ffb9977620e600d747be28466dd055c4ece709ce675ec6f667c031697f0612
SSDEEP

192:YTIZRgPfqLlvIOP3bdS2hkPUDkhoCM/vPXcqgzQkvEmO:YT7YgAdDkUDvCWpgzQkvE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2748	2256	rundll32.exe	28
PID 2256 wrote to memory of 2748	2256	rundll32.exe	28
PID 2256 wrote to memory of 2748	2256	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\setup-x86_64\Cryptodome\Cipher\_raw_cfb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2256 -s 80
  2⤵
  PID:2748