022c60b5ff582e260a77a79e0a44916c778f9a4b335a9f2c1977dfa4d281e872

Analysis

max time kernel
150s
max time network
132s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 14:40

Target

022c60b5ff582e260a77a79e0a44916c778f9a4b335a9f2c1977dfa4d281e872.dll
Size

11.5MB
MD5

41467345250bbe7442ccd6d5f50d5976
SHA1

49af79c5f6039b4d5f43482843fa122c7e7ff29c
SHA256

022c60b5ff582e260a77a79e0a44916c778f9a4b335a9f2c1977dfa4d281e872
SHA512

0d94862ac7f9068accc73cac79e750f36b56aa1edb753efaf7e5610d1deeb50d0be61d329380425f26af122fe9dc2717b654c1ba9ff07c059cdd8513ac78ca94
SSDEEP

49152:/GNhsn9kp+U8ZJ1J75J+2FkSghAlxmt6bQqcyLUbuZ4LLA0sVsee+xJVCut3qg6f:u615bp7cVLL+/NBTpI662

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1972	1632	rundll32.exe	28
PID 1632 wrote to memory of 1972	1632	rundll32.exe	28
PID 1632 wrote to memory of 1972	1632	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\022c60b5ff582e260a77a79e0a44916c778f9a4b335a9f2c1977dfa4d281e872.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1632 -s 220
  2⤵
  PID:1972

memory/1632-0-0x0000000001DD0000-0x0000000002964000-memory.dmp

Filesize
11.6MB

Download
memory/1632-1-0x0000000001DD0000-0x0000000002964000-memory.dmp

Filesize
11.6MB

Download