c1411695a46008567ed81c474298a6cade2e743d50019acb46407ed66cb11b0e

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-02-2025 09:58

Target

libpcre2-8-0.dll
Size

570KB
MD5

36acf2f31e5a520506ea69b9250f7f76
SHA1

be61a4dfbd87e6d5bc62695e1a407f2b1cf9a483
SHA256

4b7c3af719c65ce4f58abbb168cacb97d7a62935cbb711744b69dd3b058d5079
SHA512

9f8e85fb4715e03f1509689e15d9bd1e73ddb95a5b4dddc818d962375092915921df6ef665ba77a0c743a1c68fcfe2ebb9b0d91f2de2031a4cca7a610229dcac
SSDEEP

6144:D41KXET4DDeyM78l+duFg9dfjB8pyU4Ot8ZzpQGeFg6KUqrx6qbu6FUF8:E1KXpwMedflQGeOGqJbu6FUF8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 1328	2172	rundll32.exe	30
PID 2172 wrote to memory of 1328	2172	rundll32.exe	30
PID 2172 wrote to memory of 1328	2172	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libpcre2-8-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2172 -s 80
  2⤵
  PID:1328

memory/2172-0-0x0000000064380000-0x0000000064415000-memory.dmp

Filesize
596KB

Download