5cb80517080877310365a399fb8fd912f3960ba0c9e32da0e381f341934a8859

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
13/11/2023, 04:45

Target

5cb80517080877310365a399fb8fd912f3960ba0c9e32da0e381f341934a8859.dll
Size

81KB
MD5

907e689a31b1a98cefe5a356ecde2fcb
SHA1

4c35b1f909baf42f7bd45b8d3e04355ec21eec01
SHA256

5cb80517080877310365a399fb8fd912f3960ba0c9e32da0e381f341934a8859
SHA512

7ea6b842590c20c98cabe8a563da4853743f821e098269225564c25c32c15166c136990d4d902b81bd310a98baca204fe66156e5a6a5235666509bc38fc5598a
SSDEEP

1536:zYbapOqEPpgYeL2JpKhN8rZWliHnDS3/YQE:kbawO2cN8141/YR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2884	2880	rundll32.exe	28
PID 2880 wrote to memory of 2884	2880	rundll32.exe	28
PID 2880 wrote to memory of 2884	2880	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5cb80517080877310365a399fb8fd912f3960ba0c9e32da0e381f341934a8859.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2880 -s 108
  2⤵
  PID:2884