a73e3a58ee40d331a22ff7a42221d155126559065108a1da6428fb79e67c887f

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 22:00

Target

Endegyldighed/ingemanns/libffi-7.dll
Size

29KB
MD5

43c639b6ba8415f94b8fc27a96042650
SHA1

07ed717e5032f2025f759ef484fc25178922768c
SHA256

d07afee9199e6cbf406f7e6a7f9673296bda5244e5ca79a37177226f12801d35
SHA512

eeadc1f19a633ab2b05c4466de6d35cfb7c76a731d8ac23e5cbf7005ed905874c43bfc6f5da9aeeab66aad00584862df691e7ae8e5da805ee1d9608cb6663b0d
SSDEEP

384:PC9/Hckzur4W7phM9EsXbD37e9t8TlfJJD+QiUZ5ZqtIsNYF5VYJO0mnwrRCXWxU:q9UkeXMNXbD37e9LUZfqtkLVYJXuWc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2252	2236	rundll32.exe	30
PID 2236 wrote to memory of 2252	2236	rundll32.exe	30
PID 2236 wrote to memory of 2252	2236	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Endegyldighed\ingemanns\libffi-7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2236 -s 80
  2⤵
  PID:2252

memory/2236-0-0x000007FEFAFD0000-0x000007FEFAFE0000-memory.dmp

Filesize
64KB

Download