42247676388c1b036ef4ee106664ad146713c013423448123cc94ccf25500bfe

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
02/11/2023, 15:54

Target

42247676388c1b036ef4ee106664ad146713c013423448123cc94ccf25500bfe.dll
Size

106KB
MD5

41a040786a1ee25e2fb491d81bbbc598
SHA1

8a6beb4bd55f920686ab06730b409ed80ee16d44
SHA256

42247676388c1b036ef4ee106664ad146713c013423448123cc94ccf25500bfe
SHA512

8957d4e0ee6410a9df4df4a9c7a9422ea78895961ef261b97f8f6da228e82492a4ae48d4c6393ceb30a29e573fb042f9a9f1e59be89d0ffafcc8c2a7a15b72c3
SSDEEP

768:ItuPep4qgLpAEli0avlCDEM+0ee1h5x7M9QYM6mnnetT:MvoAf0avlCIM7O9QYM6mnnYT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 284 wrote to memory of 1876	284	rundll32.exe	28
PID 284 wrote to memory of 1876	284	rundll32.exe	28
PID 284 wrote to memory of 1876	284	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\42247676388c1b036ef4ee106664ad146713c013423448123cc94ccf25500bfe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:284
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 284 -s 96
  2⤵
  PID:1876

memory/284-0-0x000007FEFB1F0000-0x000007FEFB201000-memory.dmp

Filesize
68KB

Download