728728241ce96c39aff2b19e0adfcb3f4e76ca85092f1f519a6461674d976a10

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 05:19

Target

testing build/build.dll
Size

470KB
MD5

0db17eba81813d1b40004bdbcb63f243
SHA1

3cde9489e6f318037bba325f69d9e03604e95df5
SHA256

af530c6e96a23e220e27c0d5d294d72e3e8652b1a83f9c34484f742ec878420f
SHA512

0ce659593fdf61728e3eee044974a80818c8d33dc92973387abbab1c7a3fad9d40ad23116cf3c97bcc43f6294c5737c37ae129b16c15a6823a0ed3f6ba238db4
SSDEEP

6144:DhjKs8OZPhSrWu/KLXjRvuHd189cTb/820OIN8qOhj+x6eJhMGVVV8NAfku33e1:DLPhSQLjlcBTbk20OI6Zj8g0VxT+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2032	2152	rundll32.exe	28
PID 2152 wrote to memory of 2032	2152	rundll32.exe	28
PID 2152 wrote to memory of 2032	2152	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\testing build\build.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2152 -s 72
  2⤵
  PID:2032