054563b990be966899bbcd4ebb0b13971452da21416c3db8a37a18828d197ca0

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
15/11/2023, 11:59

Target

054563b990be966899bbcd4ebb0b13971452da21416c3db8a37a18828d197ca0.dll
Size

121KB
MD5

8c4b5ea3345202a919c8c7b2e0e6e476
SHA1

04c681cc6afd5370eca015684c86485423b18200
SHA256

054563b990be966899bbcd4ebb0b13971452da21416c3db8a37a18828d197ca0
SHA512

b1a8e52ffa1d6ea81bfd7be12d9605eca3b1a189048ffb3d380f26b56b67b12542677a0eaedaec95ddb470fe53040a3f830bd98419f1f46665a7861b02996d60
SSDEEP

1536:ZDG761fYXDFdtn6VN8+cFxLind8U2DTodlyz+:ZDI61YDTtYN8fHLQ2U2DTovyz

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2932	2864	rundll32.exe	28
PID 2864 wrote to memory of 2932	2864	rundll32.exe	28
PID 2864 wrote to memory of 2932	2864	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\054563b990be966899bbcd4ebb0b13971452da21416c3db8a37a18828d197ca0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2864 -s 108
  2⤵
  PID:2932