fd229f039195922fc9186f0747cf83ac4fbdb07bc0338a2922fec2e8afc1d873

Analysis

max time kernel
122s
max time network
135s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 19:40

Target

18b13a99ca3753f6c0c3186cd21d0e8a09ee4864e2789009667569b6cfcdae4a.dll
Size

1.2MB
MD5

ca683aa7445ebacf5e3044e3db354e4d
SHA1

eb3000f84538fd9520812da83bd916bc5831536d
SHA256

18b13a99ca3753f6c0c3186cd21d0e8a09ee4864e2789009667569b6cfcdae4a
SHA512

d9208705099d48f4deb572355edbaab4e13d480ca3bdaede8fc5b8a413aed531896f2e6f6cbf1c502a5a7196260fd2e03701e761089002d51cedb698390d2b4f
SSDEEP

24576:RteM3+6YRXor9wMbCjezGzTC3EPvQip626fsaDZ31mEGYKLVmTANeyKf:trgq4ZzCEHiN1tKLVzq

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1916	2240	rundll32.exe	28
PID 2240 wrote to memory of 1916	2240	rundll32.exe	28
PID 2240 wrote to memory of 1916	2240	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\18b13a99ca3753f6c0c3186cd21d0e8a09ee4864e2789009667569b6cfcdae4a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2240 -s 84
  2⤵
  PID:1916