d3284bef52954edbfae478c79b74e35cbc144059dd79c5ea207abf67bbfbd66e

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
24-10-2023 04:39

Target

d3284bef52954edbfae478c79b74e35cbc144059dd79c5ea207abf67bbfbd66e.dll
Size

257KB
MD5

8228db2a76f9a5ba7ba4a72ace6fbd90
SHA1

0da20eb0e9e4db95b6b1f071d9b5422eba4f672f
SHA256

d3284bef52954edbfae478c79b74e35cbc144059dd79c5ea207abf67bbfbd66e
SHA512

617b64d62ee6291ebc190823f317379aab4287bfeb8498110f5011e4ebc102b87cc8f9973c29cc5a8bb1366df7ad3ee43ea53333f381fbe8773119bdca710614
SSDEEP

3072:nsYckn3Xzq4IDwSK2Mb1KdEJwJNJsCwQTIfXouPruOOTRK9BQYJerCoAP:nsYwjwI7dEJweGTIDjhOTREQ8f

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2804	2800	rundll32.exe	28
PID 2800 wrote to memory of 2804	2800	rundll32.exe	28
PID 2800 wrote to memory of 2804	2800	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3284bef52954edbfae478c79b74e35cbc144059dd79c5ea207abf67bbfbd66e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2800 -s 108
  2⤵
  PID:2804