1acf1d1da26c06e974d81f68bcc73302ab8a3c8ec4d3bf5cdb550a8b48275577

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
15/11/2023, 14:53

Target

1acf1d1da26c06e974d81f68bcc73302ab8a3c8ec4d3bf5cdb550a8b48275577.dll
Size

121KB
MD5

96d9002964bf5b805dc37ed253fdcc55
SHA1

45f5452e283ae50284adc75724ce9cc7cd1d251d
SHA256

1acf1d1da26c06e974d81f68bcc73302ab8a3c8ec4d3bf5cdb550a8b48275577
SHA512

111f7105fc2b9fc1cf381c114ebc88bc800b88fc5050485e117e9629100b03b1ab9b3f2e6c8005d13e90cabdc5fff857678aabc4db8230648610809262845869
SSDEEP

1536:I0nWXbOUMDqfuPFTrisN8+tyiSS9UCnBDqMVX:I0noCUMDFPJtN8CRRDq4X

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2460	2000	rundll32.exe	28
PID 2000 wrote to memory of 2460	2000	rundll32.exe	28
PID 2000 wrote to memory of 2460	2000	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1acf1d1da26c06e974d81f68bcc73302ab8a3c8ec4d3bf5cdb550a8b48275577.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2000 -s 108
  2⤵
  PID:2460