fe8d7a1d177aa7b33528584cffcc0d4ec11f9fa8a400dfb802d88748fa7cd35f

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-12-2024 21:25

Target

SOERGESALUT/NEPHROLITHOTOMY/Agrostis7/Coccosteus1/libbz2-1.dll
Size

96KB
MD5

fd0b2bd2ae13d41de526b57e435c7fb5
SHA1

55bb61c011180eaa172a83feefc38d8fe7c5498b
SHA256

e996e8d18fa41407d80680adb9e416d916f7320e4559485ce3e3e5de811dca1d
SHA512

d7ebda50787aec915c6e3eab880a01dfc8925166c2cd2c1c70cc8ee505f17117f9e6ae9b1d57048df29bbd8705070618650a09ded64750e422a10e0365afa74e
SSDEEP

1536:DDrxVw7IsNwmkMdKx711fvsOrTJ7X3OUTT4okcTzn8P8xF3Y:/rxXsNBdKJfUORz9n4cTz8PKF3Y

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2692	2068	rundll32.exe	30
PID 2068 wrote to memory of 2692	2068	rundll32.exe	30
PID 2068 wrote to memory of 2692	2068	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SOERGESALUT\NEPHROLITHOTOMY\Agrostis7\Coccosteus1\libbz2-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2068 -s 80
  2⤵
  PID:2692

memory/2068-0-0x000007FEFB4B0000-0x000007FEFB4CF000-memory.dmp

Filesize
124KB

Download