fc77e5bdbc74120a3003bac0021871ccf74a182ce068aece06a7acf00363810c

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
05-12-2024 17:08

Target

InstalIеr-x86/cfg/styles/qwindowsvistastyle.dll
Size

226KB
MD5

6bea57a7fd8f380de36b89d9bfa6a209
SHA1

dbcdf8cbbc8914b2a2fbbd81362dc6cd97378a8e
SHA256

8a864f327756bc0ed0d16c52f37c4c652e7f440081199dcea93ce5839442ee69
SHA512

d4c28ee0be0f986be7e8c07e4b42393824836e084cee89cf699a1a3d911f1280201321666f070ce743a34ea5810b85b0cc4207f72d55e88c62509d3e070d1b8a
SSDEEP

3072:zesbD7Kt3oc+kwwPyjHB3UxqFBArvxXJblgQfMJa5MBuiOWnCT0NGcIRS:P+o3GPYBUeyvxXplPqBuiOWnCT0NYR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 576 wrote to memory of 2272	576	rundll32.exe	31
PID 576 wrote to memory of 2272	576	rundll32.exe	31
PID 576 wrote to memory of 2272	576	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\InstalIеr-x86\cfg\styles\qwindowsvistastyle.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:576
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 576 -s 52
  2⤵
  PID:2272