7bdb19204fec2ec0addc3761372caef85894bacf999c6c2fe80c64eef3abd936

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-12-2024 23:48

Target

Makala Executor/bin/xxhash.dll
Size

46KB
MD5

70c514826d9428f184d27f0c8f397404
SHA1

e6b0b1a396de9913004d9bcaa230972686416bb6
SHA256

aff59e91d222b75b3e3ac789baba9e24eff99796261ae5e887ef9e3c28bb3d64
SHA512

168c63cbb54865ca42a884fd974291bcadd9dd8cf8bc1980148214e84498af42a590cb3d3a394765ee0b7d2e337fab6e85ff4f85d9ced97b92b540152202a0a6
SSDEEP

768:tziPp7yW4k3QDn24NuDUSu0MKQVMNKuxYAuogba4Mk3Q18swN1WQ8hi6U:tziR74kgDn2rDRuIrN5mAvgbTg18DN1z

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 2664	1600	rundll32.exe	30
PID 1600 wrote to memory of 2664	1600	rundll32.exe	30
PID 1600 wrote to memory of 2664	1600	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Makala Executor\bin\xxhash.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1600 -s 80
  2⤵
  PID:2664