a887bc1b37f7660e12efca2cb74765357b3e788b36439283425e804ffcb51d6e

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
30/09/2023, 23:23

Target

a887bc1b37f7660e12efca2cb74765357b3e788b36439283425e804ffcb51d6e.dll
Size

148KB
MD5

f6f6c9965c9ea59eaf3cfb4760918826
SHA1

ec7aad378fc3dcfca66d9c1740b173ef91397bbe
SHA256

a887bc1b37f7660e12efca2cb74765357b3e788b36439283425e804ffcb51d6e
SHA512

3fccc887d6c97b14069f5a519e0c0ba131af46d35e4610697f017b6e1924218bae48e1bd04f910ede754a0fb90acea2778c7257f752a09b16dd08d0c4b5273ab
SSDEEP

3072:eV0yP5KWZBsnYtmUUG0iWjoqerIKR7v9999999Wp9BxY:o0yBB6YtmUpBWjob56Y

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 2236	1272	rundll32.exe	28
PID 1272 wrote to memory of 2236	1272	rundll32.exe	28
PID 1272 wrote to memory of 2236	1272	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a887bc1b37f7660e12efca2cb74765357b3e788b36439283425e804ffcb51d6e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1272 -s 84
  2⤵
  PID:2236