1c0b9425bb2f4e39eb64cae968fc3c9ea83f9067dd95db6adb616e7d7f71f322

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 00:27

Target

ConsoleMD/ConsoleMDChannel64.dll
Size

169KB
MD5

dda850012355a04cb2200d8447284570
SHA1

06e9539e4ee0b5674430aa6b0e6a36914f0305fc
SHA256

a51ce4e009d91b08e1dd6e6964bb3747a7123474db23540a3d6a214c8fb35428
SHA512

1fbabfc378c01f2945d0a3e1e3aefc2ed8ecd9a48e93d6fa456b02c506c364ee9461526ea3cb0205d3633f26385c33ccfd30bdfe5aa8841723ca27ab30c88471
SSDEEP

3072:yTgSpVTIKYcPy7w1SyDqrQbo20S0o87oY4lXkTaHhE9cjK9:sgS1Ny7w1Sy+720SWohIafK

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2456	2472	rundll32.exe	28
PID 2472 wrote to memory of 2456	2472	rundll32.exe	28
PID 2472 wrote to memory of 2456	2472	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ConsoleMD\ConsoleMDChannel64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2472 -s 84
  2⤵
  PID:2456