0ee6265fb360ff4f06ac38b3f69689d3e74889a8ed9f92c2cb21a90e9efb2263

Resubmissions

29-11-2024 14:08

29-11-2024 14:03

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-11-2024 14:03

Target

bin/reports/ati_compress_wrapper.dll
Size

736KB
MD5

6289cb9973840bde3258392cc07b4420
SHA1

84aaa5491087ffb7aa5453f48bdf3a837839f770
SHA256

59b8e6afa8bd163213b63bbc8b7af18e495ddebee801ebda39ef62fd559901c3
SHA512

8e64cdfa9f916b1b86a2e1798562c61d63bd13920e5d76a4a80d74f46991219961ca8354d359fcddfaba25b358254e632c73a4c74f61b444cad4fe6f10c6f0c1
SSDEEP

12288:nWVwk2whmH7nU7OV/EWvpu1jvb+HE8SHs3dv/T58kr1Jmy:nEhmH7nU7OV/E4c1TMy8N8Hy

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 1944	2580	rundll32.exe	31
PID 2580 wrote to memory of 1944	2580	rundll32.exe	31
PID 2580 wrote to memory of 1944	2580	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\reports\ati_compress_wrapper.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2580 -s 80
  2⤵
  PID:1944