d011d7ab765f112ee110e49949b24948d586df0dccc4f5430baf7ba9317b7d05

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-11-2024 04:07

Target

TrafficMonitor_1.84.1_64bit_Green/TrafficMonitor/OpenHardwareMonitorApi.dll
Size

264KB
MD5

0fe5a3eff943e12cc65cce05ff634e22
SHA1

bfb6d130ebf70018c14e48859c824f54f0da0248
SHA256

f7fb610d35c7e42187d7b8cd90dce87a70257b5abfe2a33243946ba24eb8a0e6
SHA512

9bf6eea69aa446bc2ae4e8acd4ce1b7e93e30480546ef652fe7fa1f22a09adfac06884ddebcd711895fa5ea5e5cb267e901e466233a11e964c07771a93885946
SSDEEP

6144:70Nl2t2ZMo44+WrIYq6oGyZQWrW/UwPTd3uEQqqVkDf2JKtAov:7r2ZEHH76oGyZQYIUwPR3uEQqqVjk

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 1904	2292	rundll32.exe	28
PID 2292 wrote to memory of 1904	2292	rundll32.exe	28
PID 2292 wrote to memory of 1904	2292	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TrafficMonitor_1.84.1_64bit_Green\TrafficMonitor\OpenHardwareMonitorApi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2292 -s 540
  2⤵
  PID:1904

memory/2292-0-0x0000000001DD0000-0x0000000001E50000-memory.dmp

Filesize
512KB

Download
memory/2292-1-0x000007FEF5FB3000-0x000007FEF5FB4000-memory.dmp

Filesize
4KB

Download
memory/2292-2-0x000000001A9D0000-0x000000001AA17000-memory.dmp

Filesize
284KB

Download
memory/2292-3-0x000007FEF7960000-0x000007FEF79A7000-memory.dmp

Filesize
284KB

Download