6a47bed443d129fb6c3661b64547971090889b7c1a8fdf8d27bd804d5f5dd1d8

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
16/10/2024, 23:13

Target

locales/resources/app.asar.unpacked/keytar.dll
Size

691KB
MD5

c5c99144e2e1589628e14999ba59ad73
SHA1

9c80f8de6b5cdaf38677d5368b5287bacb9e465a
SHA256

90e35de89ab5e5f9290e4ff1bbadcf221a82b2aa0d9b922187dc980adff3c831
SHA512

0bcb99953397c6604d8e08bf2ba89248ee82f92436c2dcc779157b65227b0e1350927273a1b6d150a9db914d0a8830680df05ef651ee291b40657a3025a721c5
SSDEEP

12288:cRInDhSzUpqDDa2XX05VNpk4th460iQlp1Qk5wUFPcvKKR0JQQ8jKOx8:cOnDHpqnaskrdx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2872	2876	rundll32.exe	30
PID 2876 wrote to memory of 2872	2876	rundll32.exe	30
PID 2876 wrote to memory of 2872	2876	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\locales\resources\app.asar.unpacked\keytar.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2876 -s 156
  2⤵
  PID:2872