22bdec013954160291c36c833a788b59c40d6758443418cf7a206f549f3d4873

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/12/2024, 16:15

Target
hyperbarbarous/libbz2-1.dll
Size 96KB
Sample241221-tqb9cssphr
SHA256 e996e8d18fa41407d80680adb9e416d916f7320e4559485ce3e3e5de811dca1d
MD5 fd0b2bd2ae13d41de526b57e435c7fb5
SHA1 55bb61c011180eaa172a83feefc38d8fe7c5498b
SHA512 d7ebda50787aec915c6e3eab880a01dfc8925166c2cd2c1c70cc8ee505f17117f9e6ae9b1d57048df29bbd8705070618650a09ded64750e422a10e0365afa74e
SSDEEP 1536:DDrxVw7IsNwmkMdKx711fvsOrTJ7X3OUTT4okcTzn8P8xF3Y:/rxXsNBdKJfUORz9n4cTz8PKF3Y
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 2112	1568	rundll32.exe	30
PID 1568 wrote to memory of 2112	1568	rundll32.exe	30
PID 1568 wrote to memory of 2112	1568	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hyperbarbarous\libbz2-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1568 -s 80
  2⤵
  PID:2112