54ce56fed7704053d3e6d3c9d624937a0d1617cf925a4f0100cbcd8f55539314

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
30/10/2023, 15:19

Target

9922c46f9d734ca02bbec54e2bcb35f166f634a33775b9619ad16f57aba2af13.dll
Size

1.2MB
MD5

abced1af9087b1be741c109a8fc3ed59
SHA1

eba6c9c363a5386b8e07de0df7a4458a6d4376e4
SHA256

9922c46f9d734ca02bbec54e2bcb35f166f634a33775b9619ad16f57aba2af13
SHA512

24eef57ceeacd28e7afdd5046270c1b891ba6eb1a09ff6874f1d320e7b91b2cc7e9cae94ec844ba257b09eed349ef8e8978e98d43b94c1cf5f46f963c55c860a
SSDEEP

24576:hmJByBxUwi/uUy74InSKf290MFK7YnlAf46KE/eRLlBi303/Un1lrZQuwnHrrdd6:02O+SKfQhvlB1v6rileRd

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2920	2868	rundll32.exe	28
PID 2868 wrote to memory of 2920	2868	rundll32.exe	28
PID 2868 wrote to memory of 2920	2868	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9922c46f9d734ca02bbec54e2bcb35f166f634a33775b9619ad16f57aba2af13.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2868 -s 84
  2⤵
  PID:2920