2b9e2bdeb348be368e9cafd06c15414bbe725af32a8c40ee56c3266db8a5b2a3

Analysis

max time kernel
13s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-12-2024 17:46

Target

Debug/bin/xxhash.dll
Size

46KB
MD5

70c514826d9428f184d27f0c8f397404
SHA1

e6b0b1a396de9913004d9bcaa230972686416bb6
SHA256

aff59e91d222b75b3e3ac789baba9e24eff99796261ae5e887ef9e3c28bb3d64
SHA512

168c63cbb54865ca42a884fd974291bcadd9dd8cf8bc1980148214e84498af42a590cb3d3a394765ee0b7d2e337fab6e85ff4f85d9ced97b92b540152202a0a6
SSDEEP

768:tziPp7yW4k3QDn24NuDUSu0MKQVMNKuxYAuogba4Mk3Q18swN1WQ8hi6U:tziR74kgDn2rDRuIrN5mAvgbTg18DN1z

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2652	2656	rundll32.exe	30
PID 2656 wrote to memory of 2652	2656	rundll32.exe	30
PID 2656 wrote to memory of 2652	2656	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Debug\bin\xxhash.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2656 -s 80
  2⤵
  PID:2652