c07f27225096650b51c0f98eccaca5d3b460208b02ee94a00b59021567702e39

Analysis

max time kernel
91s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 04:16

Target

c07f27225096650b51c0f98eccaca5d3b460208b02ee94a00b59021567702e39.dll
Size

76KB
MD5

6e9b1cd25352c8e55de900c77faa90c5
SHA1

fea5a192422d58109da31e4e50b2bf519a6efce8
SHA256

c07f27225096650b51c0f98eccaca5d3b460208b02ee94a00b59021567702e39
SHA512

74ce88f44423c448fad8390e448f8001560581de697ebb32c430255dd3c8d9a43bf3ea3241c43c9dd09caacb1dfacc011d25caaf03443dfde071cfa790b3165d
SSDEEP

1536:Zwoq+LsVXPM1MgkwZDc6onDspkyMIhy25ZwX++D6V1qbXdbNZLOfwX:ON+oVX0tZDclDsrn90DE1qbdbNuwX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 4132	2200	rundll32.exe	81
PID 2200 wrote to memory of 4132	2200	rundll32.exe	81
PID 2200 wrote to memory of 4132	2200	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c07f27225096650b51c0f98eccaca5d3b460208b02ee94a00b59021567702e39.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c07f27225096650b51c0f98eccaca5d3b460208b02ee94a00b59021567702e39.dll,#1
  2⤵
  PID:4132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4132 -ip 4132
1⤵
PID:3908

memory/4132-133-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download