e47b56e70d125b9dfe3f11dc5b50f4e7a64445fd24d08e473610ef989b383a49

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 14:56

Target

Slinky/slinkyhook.dll
Size

228KB
MD5

6d8c17c67970cb5841811eed8adffffc
SHA1

c869ab32318a035e51aff8e5e11b4cd25fb52a4f
SHA256

7c4234fac3b6b3e96dace1e71c7a952ec67e3839f90f7a88a9ea283bf88d25b8
SHA512

7d2a0ffcd72c8bf4a96b2ed722d7119749ec14f5d7e6a601cb6ae4a5b1c4a652b694158f01da340e3ca4751cabd0a56c42bf739d8b421e36937f3691b3b80c72
SSDEEP

3072:hXxN1I6PgabbAzVxPLI5oIa5amK/1o4ptgELHY1lNyc+m+e7P26g66OVuknsDe0u:hhN1GFZq/15tFc+m97ieuknsDu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2220	2784	rundll32.exe	30
PID 2784 wrote to memory of 2220	2784	rundll32.exe	30
PID 2784 wrote to memory of 2220	2784	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Slinky\slinkyhook.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2784 -s 156
  2⤵
  PID:2220