c6d181316a032547611b42cf657440444b94d57509262f2e11b29212c31642f9

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
18-12-2024 17:56

Target

KINGDOM/lua53-64.dll
Size

528KB
MD5

b7c9f1e7e640f1a034be84af86970d45
SHA1

f795dc3d781b9578a96c92658b9f95806fc9bdde
SHA256

6d0a06b90213f082cb98950890518c0f08b9fc16dbfab34d400267cb6cdadeff
SHA512

da63992b68f1112c0d6b33e6004f38e85b3c3e251e0d5457cd63804a49c5aa05aa23249e0614dacad4fec28ca6efdb5ddee06da5bfbfa07e21942976201079f3
SSDEEP

6144:FshVOadaiL9mUHQMpgL8LgpqClZNKX6SumisBEb/NUidzSky3uDMK/LXTMBQqN5T:hOL9J2L8E5VKKSuLGEhXGstCXoYkc7BV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2872	2808	rundll32.exe	30
PID 2808 wrote to memory of 2872	2808	rundll32.exe	30
PID 2808 wrote to memory of 2872	2808	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\KINGDOM\lua53-64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2808 -s 80
  2⤵
  PID:2872