b5721d616aa2e9770be2e87a56f670f1c2db6bc7e44c2b2bad731fbd4cb196f5

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-12-2024 04:06

Target

bin/xxhash.dll
Size

46KB
MD5

70c514826d9428f184d27f0c8f397404
SHA1

e6b0b1a396de9913004d9bcaa230972686416bb6
SHA256

aff59e91d222b75b3e3ac789baba9e24eff99796261ae5e887ef9e3c28bb3d64
SHA512

168c63cbb54865ca42a884fd974291bcadd9dd8cf8bc1980148214e84498af42a590cb3d3a394765ee0b7d2e337fab6e85ff4f85d9ced97b92b540152202a0a6
SSDEEP

768:tziPp7yW4k3QDn24NuDUSu0MKQVMNKuxYAuogba4Mk3Q18swN1WQ8hi6U:tziR74kgDn2rDRuIrN5mAvgbTg18DN1z

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 1040	2408	rundll32.exe	28
PID 2408 wrote to memory of 1040	2408	rundll32.exe	28
PID 2408 wrote to memory of 1040	2408	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\xxhash.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2408 -s 80
  2⤵
  PID:1040