f266e2fb3de7c85ece28032317f577ea730183e1ccc6e597005615b355e7b60e

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
25-12-2024 11:41

Target

LenovoSdk/x64/LYSDK2.dll
Size

3.3MB
MD5

8412cb29ef8ff819a1fa5b1e9ed0e2a8
SHA1

889a6e17e0a5a3e667d48743e13692a861ceaf7f
SHA256

6647f66dbc3913af922f8544e297a67ecbb8c010ad26791d74f3af85d3d7c667
SHA512

3aec0553a70309c1efc4967e9da807d23ec28a0ab05d8cb982223dc3c4c77fe0ed2f7ba5abec92f61486088b87dad7daae3d5ecdcb5e2a36b64b894f75e33228
SSDEEP

49152:/Z/YEZ+OCaXWDaShlSYCrh6pKR6w2OWt2HsjBAkmWQ7nyLPfQYwJvECooPvz8t46:B/YEnC7DoTD/ytwJY5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 2572	1492	rundll32.exe	29
PID 1492 wrote to memory of 2572	1492	rundll32.exe	29
PID 1492 wrote to memory of 2572	1492	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\LenovoSdk\x64\LYSDK2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1492 -s 240
  2⤵
  PID:2572