a50ef8bbeb3468b1eb76246551b98f0500e597c0a1d1cd552e9951cea572f6e0

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/03/2025, 22:33

Target

XHorionUPDATED/XHorionUPDATED/XHorion/bin/libvpl.dll
Size

502KB
MD5

0a678cefdfccb717a9745f9294a61109
SHA1

0c25235ae23faf11e9a7855afe0628c8499ca500
SHA256

3b8ceb7c978665b75ee6ddf3bc7efbd8e9ff03edcab44dfa92f3b667586c36c6
SHA512

c446a9e10cddbce4cf5181ba56b412ae96beb3ece5ad29298f05a54ab8fd0f21a8ad1c586f4f2150d9b899da73981da748e4bc9ec0bdc820e3ff5730b068729f
SSDEEP

6144:XTNdC09UJs/NxfjxY4MyZyVThwbjR2qdASddRhBhoM:Us/NxdY4yaboGdzP6M

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 2856	2612	rundll32.exe	31
PID 2612 wrote to memory of 2856	2612	rundll32.exe	31
PID 2612 wrote to memory of 2856	2612	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XHorionUPDATED\XHorionUPDATED\XHorion\bin\libvpl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2612 -s 120
  2⤵
  PID:2856