a8e7fcd3082840075dae30a1604cffb215299f554561ba6258658d5511bb9d6d

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31/01/2025, 18:55

Target

boost_filesystem-vc142-mt-x64-1_84.dll
Size

156KB
MD5

2c278766d13eef3de18561a65a8e7333
SHA1

e322ee2a6f3684a562d96243174497a850306bdc
SHA256

869184cab395c9aab4c6e05c8344648fd757b62619a9ac207db3345841e3ee1d
SHA512

6de25639732e9d64700d601f59c4cb8e91078df56e04e7ddf2e53c4c34bda9ece3ed1568cb663977a333c17c03606fe2ed84cb30bfacf56a7835bbec4a7f707b
SSDEEP

3072:H5M8wVJSUbnuYmDDpikCOLBnsXn7DVUI4Ku8BoGBO:G5VJS+uYmDDpiQLBnY7pUI4JwoeO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 3020	2912	rundll32.exe	30
PID 2912 wrote to memory of 3020	2912	rundll32.exe	30
PID 2912 wrote to memory of 3020	2912	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\boost_filesystem-vc142-mt-x64-1_84.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2912 -s 96
  2⤵
  PID:3020