0f6488ec68bc79c8f5987d1d97c32bc164033639d13f3bbcb0e7d2a6017b1c54

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26/02/2025, 17:50

Target

empyrean-grabber-discord-main/vcruntime140_cor3.dll
Size

106KB
MD5

870fea4e961e2fbd00110d3783e529be
SHA1

a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA256

76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA512

0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88
SSDEEP

1536:DcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/Auecbq8qZU34zW/K0zD:DV3iC0h9q4v6XjKAuecbq8qGISb/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2156	2484	rundll32.exe	30
PID 2484 wrote to memory of 2156	2484	rundll32.exe	30
PID 2484 wrote to memory of 2156	2484	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\empyrean-grabber-discord-main\vcruntime140_cor3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2484 -s 80
  2⤵
  PID:2156