fd8c67221caf2b1f5ffcf490fe565862b060d95c6d51d2a17239fd53f4e9bdd5

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 12:26

Target

fd8c67221caf2b1f5ffcf490fe565862b060d95c6d51d2a17239fd53f4e9bdd5.dll
Size

282KB
MD5

306ec083a05171abae079489a9b65191
SHA1

87f9074114b901b2ef91fb50b15fd46d5a37738d
SHA256

fd8c67221caf2b1f5ffcf490fe565862b060d95c6d51d2a17239fd53f4e9bdd5
SHA512

c11687f920fb11238e412bec557de43bb4ed10561025e1f2e5a2f272c7f248c701ca6d786325a7653fe468628bba6a24a48be9c717d147e6a1861d5e05c4d694
SSDEEP

6144:BRSMIJF4Ka31yrusxnrsbOohMXbR7bcl0rC+:BRMJ+Ka3srsbOoul

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2252	2256	rundll32.exe	28
PID 2256 wrote to memory of 2252	2256	rundll32.exe	28
PID 2256 wrote to memory of 2252	2256	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd8c67221caf2b1f5ffcf490fe565862b060d95c6d51d2a17239fd53f4e9bdd5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2256 -s 120
  2⤵
  PID:2252