cfcd10600d1606d39f345271772578aca4c5c489aebfc4cc870aed1036437234

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
19-11-2024 17:11

Target

data/data/lwjgl_tinyfd.dll
Size

209KB
MD5

5dc7452c51330beb7a178d7093cdac49
SHA1

ec0fd8007afba6697d5b3b8249b5be27096a0ce8
SHA256

696a87865bf27f2cb9bc866e6d75e1a4ee3e8c469180cb9f8ebb90a2af876d10
SHA512

a671123d7ea2f5dd2f307e19627b456b7a1fe62920c64cb08fdcc4be5f0ba017c5b72a0e9ba428fa5996a82584e039818bc41051b7e883d70252b69926f82716
SSDEEP

3072:7+Oyz6WBIDhWW3gDYP1EKvqotQZGXNKSMYghpYCS1DQmdJQFACZ1sai3Uzz2KC:7+zxShWW3gDYtC7cXfMY63S1ag/bK

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 844	2344	rundll32.exe	31
PID 2344 wrote to memory of 844	2344	rundll32.exe	31
PID 2344 wrote to memory of 844	2344	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\data\data\lwjgl_tinyfd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2344 -s 232
  2⤵
  PID:844