92a8d29853d1891492fef0660aa44e8cf591269a42e008885a64625528b06a31

Analysis

max time kernel
158s
max time network
131s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 08:43

Target

92a8d29853d1891492fef0660aa44e8cf591269a42e008885a64625528b06a31.dll
Size

482KB
MD5

57e4ef873693892da6c20512fefb6dff
SHA1

5ce485c9739bd2f82175d557444fd0f5f00646a7
SHA256

92a8d29853d1891492fef0660aa44e8cf591269a42e008885a64625528b06a31
SHA512

2973b8ae186ec0e5652cd5f2ee79b8cb4d05c1f56df4c22dbeb7fb81b4aab72fc2ab3a0bc757bca71a8e095ce4aa28ff0c60a8b09247464f7487eb2199b7821a
SSDEEP

12288:65hlJthDY7hlPJMFN8hbAvNQPjapvZZSGGBwdY5H:65hlJthDY7XPSFN8JcNi+pvfSz5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2232 wrote to memory of 2244	2232	rundll32.exe	WerFault.exe
PID 2232 wrote to memory of 2244	2232	rundll32.exe	WerFault.exe
PID 2232 wrote to memory of 2244	2232	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92a8d29853d1891492fef0660aa44e8cf591269a42e008885a64625528b06a31.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2232

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2232 -s 84
2⤵
PID:2244

memory/2232-0-0x000007FEF6E60000-0x000007FEF6EE5000-memory.dmp

Filesize
532KB

Download