59e4fac681f8e2e2db47821e1d1e1d76713363dadd006ee060d396b363c43e27

Analysis

max time kernel
120s
max time network
139s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
04-01-2025 14:08

Target

windows/libSwiftDemangle.dll
Size

413KB
MD5

80016ffb38757c4d5726434ba693035c
SHA1

6e14c75bda593796d89921a119fc11d6e3cf54ea
SHA256

0fc2ecd20793f573ca1d3e9d5080f54a856a4706b774231ed736169c3db919c3
SHA512

285af4ae374750304e4372e42fb930edcd8bd1da832aa88156317d27f1dc6fa76eaa8e7ae36c46739d41093f1ce90d523fda872402abebf43c0d76bea4abf4c2
SSDEEP

12288:QesiZjWzolGhMEGaw/jujDDOVfiWBBCS7JzrrOI7hGC3ak:QeBZjWzolGhMEGaw/jujDDcfiWBXJzrp

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 3004	2836	rundll32.exe	30
PID 2836 wrote to memory of 3004	2836	rundll32.exe	30
PID 2836 wrote to memory of 3004	2836	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\windows\libSwiftDemangle.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2836 -s 80
  2⤵
  PID:3004