7b789067fc92947c089c7bd54324742156f04d7a2d670de4e5170c87abf72f3d

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/12/2024, 23:35

Target

_internal/libffi-7.dll
Size

32KB
MD5

eef7981412be8ea459064d3090f4b3aa
SHA1

c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256

f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512

dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
SSDEEP

384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 2480	1352	rundll32.exe	31
PID 1352 wrote to memory of 2480	1352	rundll32.exe	31
PID 1352 wrote to memory of 2480	1352	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\_internal\libffi-7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1352 -s 80
  2⤵
  PID:2480