b42b83d8f5d28451e6fac8fbc892538cc493fa687af674df48e070ca568fffe4

Analysis

max time kernel
122s
max time network
141s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 06:55

Target

e186490b3e94c621416442e2455e46c1ea9449be0d2edaa63fb93e3b8247a13a.dll
Size

1.2MB
MD5

07f847fce9131ec599c1455dce581215
SHA1

fc3c93b5cd3e79f998000b7dda684bec9d8a8d9a
SHA256

e186490b3e94c621416442e2455e46c1ea9449be0d2edaa63fb93e3b8247a13a
SHA512

3ee4cc4ed40fd0634b421e4cf9ba3b246ce525156498659c1225eb464736d8f2b5201f18baaee175fb9090fa9bb240c9de27c25526a883998eb84efd17e5e040
SSDEEP

24576:G2+iTnzomLqXkjqxUuSgX9ZpzVgAf7UC0xscSAmK+Cw9C6:/nHPI48uH+CwZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2880	2232	rundll32.exe	28
PID 2232 wrote to memory of 2880	2232	rundll32.exe	28
PID 2232 wrote to memory of 2880	2232	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e186490b3e94c621416442e2455e46c1ea9449be0d2edaa63fb93e3b8247a13a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2232 -s 84
  2⤵
  PID:2880