a97982edc5a2b47956648aee5bac78507b5903444f1fde80e583c886b69fc821

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-11-2024 02:42

Target

config/styles/qwindowsvistastyle.dll
Size

226KB
MD5

6bea57a7fd8f380de36b89d9bfa6a209
SHA1

dbcdf8cbbc8914b2a2fbbd81362dc6cd97378a8e
SHA256

8a864f327756bc0ed0d16c52f37c4c652e7f440081199dcea93ce5839442ee69
SHA512

d4c28ee0be0f986be7e8c07e4b42393824836e084cee89cf699a1a3d911f1280201321666f070ce743a34ea5810b85b0cc4207f72d55e88c62509d3e070d1b8a
SSDEEP

3072:zesbD7Kt3oc+kwwPyjHB3UxqFBArvxXJblgQfMJa5MBuiOWnCT0NGcIRS:P+o3GPYBUeyvxXplPqBuiOWnCT0NYR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2476 wrote to memory of 320	2476	rundll32.exe	31
PID 2476 wrote to memory of 320	2476	rundll32.exe	31
PID 2476 wrote to memory of 320	2476	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\config\styles\qwindowsvistastyle.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2476 -s 52
  2⤵
  PID:320