71a93e45798eabb7de03acb86e2b64c628343a2b84e9b92baa5c8b7463560faa

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
18/09/2023, 14:32

Target

71a93e45798eabb7de03acb86e2b64c628343a2b84e9b92baa5c8b7463560faa.dll
Size

178KB
MD5

5dafdc179671940c447665f7c881efcd
SHA1

f54a65bebaa53b6a9b008fd9bf79c544997b1ed1
SHA256

71a93e45798eabb7de03acb86e2b64c628343a2b84e9b92baa5c8b7463560faa
SHA512

9ee541f31aa542681b24c8ae25789e32cd29c5bae60b5633a80c9405cd8ec9d8e400d9c2bf4f0890d80509fd275a6d6c7222b7a6b28d37ffc55faa00acf78cc1
SSDEEP

3072:ITS0SQQjkGt+VLCEoYwpjAoEMYl6qA4ET4/0iVeVqWVkK5Wqii:ITVSWGwVvoYwa1lfAPTUZVoDii

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 784	1028	rundll32.exe	28
PID 1028 wrote to memory of 784	1028	rundll32.exe	28
PID 1028 wrote to memory of 784	1028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\71a93e45798eabb7de03acb86e2b64c628343a2b84e9b92baa5c8b7463560faa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1028 -s 84
  2⤵
  PID:784