634f644caf171d9aa479ad78abb7060d449588b5455ba2a0afb259102b3e3f7d

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 16:19

Target

634f644caf171d9aa479ad78abb7060d449588b5455ba2a0afb259102b3e3f7d.dll
Size

1.4MB
MD5

e4f124347bdcf67643a68c167bca5396
SHA1

46c076f15a6b676fc9242e2e647ee19e11fd7dcd
SHA256

634f644caf171d9aa479ad78abb7060d449588b5455ba2a0afb259102b3e3f7d
SHA512

6970f27909cd875a53e43e81fd39c12c64fc3d419609972f5a25cd086c175bb926db163a7883d772adbdecc0281daaae23b98099589d875e16d577904667174f
SSDEEP

6144:oKmJGZ3jWBPUbf2zkVQBbK1it3bUQkP4hEESbhrh1X9zrTno2swanEPp:o/wZ3SRzkqBSa3bJkwCFx9zrzoFwa

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 1500	2200	rundll32.exe	28
PID 2200 wrote to memory of 1500	2200	rundll32.exe	28
PID 2200 wrote to memory of 1500	2200	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\634f644caf171d9aa479ad78abb7060d449588b5455ba2a0afb259102b3e3f7d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2200 -s 152
  2⤵
  PID:1500