4b60b2960da8862d8ddb07ca1a96302bc591110dc1898a0bc6495e4fbacd56ad

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-11-2024 19:43

Target

Avernus/Avernus/bin/xxhash.dll
Size

47KB
MD5

efa2cd16a47d15deaf348156eb6e14d8
SHA1

f8c8807210ae3c2557d928e634fce6e34d48a576
SHA256

3fb171ca29d11a9f4f296d0732a5fbf5b0b0bb8b83926784b1fff168175c68b2
SHA512

bf268a01c693ac40644f5aea93a21005a8b35ae0c935e663ebeeba2afa91e46efa3ef0b9209c3328dc73ca52e71fdb85cd301f73bdc03aa1bd0d54e9307b1c0f
SSDEEP

768:s1WkmhW508rbV9uoF6QV8nBT+RYOsYeZbK9DSPot87xq8auTUol:s1aW5BrbuHbnBiGO9SbToyxq8auT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2120	2232	rundll32.exe	30
PID 2232 wrote to memory of 2120	2232	rundll32.exe	30
PID 2232 wrote to memory of 2120	2232	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Avernus\Avernus\bin\xxhash.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2232 -s 80
  2⤵
  PID:2120