88ec1852f7ecdeaa8677664917fdb3a30794176ec0e0612ceb4ff87614e0330a

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 12:57

Target

88ec1852f7ecdeaa8677664917fdb3a30794176ec0e0612ceb4ff87614e0330a.dll
Size

778KB
MD5

8afc7b8ffe70b31a727b99db5fce28f3
SHA1

acfc1bbaf90ef00a5c4245266a0afc2db3591f9c
SHA256

88ec1852f7ecdeaa8677664917fdb3a30794176ec0e0612ceb4ff87614e0330a
SHA512

ef3cc523e332c864f7845c55aece4b07d64146bb58387d7c97c194c7b15a961c3300a07fe4d00e9a8769dadb512f9afb3ed37e3adaf54611984f8501c3a373f6
SSDEEP

6144:vkS+e5mGQ1oh5eI0HS2gYDjDo+/kfqpoh1ijX3eUH+dCaxe6yLy:v6emQh5elHoYxkfqpoLijX3vaxeny

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 2936	1864	rundll32.exe	28
PID 1864 wrote to memory of 2936	1864	rundll32.exe	28
PID 1864 wrote to memory of 2936	1864	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\88ec1852f7ecdeaa8677664917fdb3a30794176ec0e0612ceb4ff87614e0330a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1864 -s 92
  2⤵
  PID:2936