525aa7b76a5d2d1604b39b12f82753f51e3d64b568cef424e1b5ab5f3d674ea3

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
30/10/2023, 12:24

Target

f395b06e62637ab1670666883625e132f47cad8a3c6198aa60130b33a47fca09.dll
Size

1.2MB
MD5

864d66e82bfe8ee80250ac371b0c610d
SHA1

8405692b4a2c10fb43058ad424d593c8f9314598
SHA256

f395b06e62637ab1670666883625e132f47cad8a3c6198aa60130b33a47fca09
SHA512

e696581166f550a09f62d5ec7a5a2db7655cae9646ddce6426d3f23805b2aac426504a7b942d3822cb683299cdf2e183f625117a05b481a932ec54bac9ff4328
SSDEEP

24576:SxOU/7+LUu4af1WAiwdwjUWHWQuONnh7AC2Dq+FRPa8DacrDS6:YKVvxa4s0HBaci6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 1320	2444	rundll32.exe	28
PID 2444 wrote to memory of 1320	2444	rundll32.exe	28
PID 2444 wrote to memory of 1320	2444	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f395b06e62637ab1670666883625e132f47cad8a3c6198aa60130b33a47fca09.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2444 -s 84
  2⤵
  PID:1320