83276003aed625b238728b9c79cf9465d3f9e3e5cda1d785b62eda136b87a969

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
16/11/2023, 08:41

Target

83276003aed625b238728b9c79cf9465d3f9e3e5cda1d785b62eda136b87a969.dll
Size

117KB
MD5

b047b96dd28cec41d455ae876a6fc1af
SHA1

1b77a86012a9e618e830b0551f375038081269be
SHA256

83276003aed625b238728b9c79cf9465d3f9e3e5cda1d785b62eda136b87a969
SHA512

8b7464bcee2d964c25c569394155a5a69ba122cf8d5eb37e9303bfa8c68808ad4b0023c3628b8aa62c686791961ff4dd29002e174fbcf2c34f8f3da75f5689a4
SSDEEP

768:mMK1OIVciJm/hOZl9k2nifU9+bF+NS9UfAogQqGUFhHmj9Z3oNAajocZ8/pbnKNj:rJvIlBisHMjrOmN8ByRDDPWuibInzky

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2208	2180	rundll32.exe	28
PID 2180 wrote to memory of 2208	2180	rundll32.exe	28
PID 2180 wrote to memory of 2208	2180	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\83276003aed625b238728b9c79cf9465d3f9e3e5cda1d785b62eda136b87a969.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2180 -s 108
  2⤵
  PID:2208