22bdec013954160291c36c833a788b59c40d6758443418cf7a206f549f3d4873

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 16:15

Target

hyperbarbarous/libbz2-1.dll
Size

96KB
MD5

fd0b2bd2ae13d41de526b57e435c7fb5
SHA1

55bb61c011180eaa172a83feefc38d8fe7c5498b
SHA256

e996e8d18fa41407d80680adb9e416d916f7320e4559485ce3e3e5de811dca1d
SHA512

d7ebda50787aec915c6e3eab880a01dfc8925166c2cd2c1c70cc8ee505f17117f9e6ae9b1d57048df29bbd8705070618650a09ded64750e422a10e0365afa74e
SSDEEP

1536:DDrxVw7IsNwmkMdKx711fvsOrTJ7X3OUTT4okcTzn8P8xF3Y:/rxXsNBdKJfUORz9n4cTz8PKF3Y

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 2112	1568	rundll32.exe	30
PID 1568 wrote to memory of 2112	1568	rundll32.exe	30
PID 1568 wrote to memory of 2112	1568	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hyperbarbarous\libbz2-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1568 -s 80
  2⤵
  PID:2112

memory/1568-0-0x000007FEFA9D0000-0x000007FEFA9EF000-memory.dmp

Filesize
124KB

Download