b552a4d89979a783e5e8a74b711ae41223302f7e0738ea02c39f9cd14dd3fb8a

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
18/11/2023, 13:04

Target

b552a4d89979a783e5e8a74b711ae41223302f7e0738ea02c39f9cd14dd3fb8a.dll
Size

306KB
MD5

59a7745bca5ae1aac1493bad73d19801
SHA1

88995500423a9c143f78528f34291b333dcd4bfd
SHA256

b552a4d89979a783e5e8a74b711ae41223302f7e0738ea02c39f9cd14dd3fb8a
SHA512

46f8e5ea9f82cbe720952921478a9895777c764ef1de284f46db1edc4c4d2415ffb0e845c2b816f57fd86f190eafdf7c068dd47d8741d96663b994521055dab2
SSDEEP

3072:iGVEMOT06ZZsmMcFTIYw7kJ1ot53VEJstVArc9DUnbDsUU/8hzyH6+CudCWyBXvP:HV3A0cgQIY71s5OJgUcxMDHuuXvWk

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2196	2268	rundll32.exe	28
PID 2268 wrote to memory of 2196	2268	rundll32.exe	28
PID 2268 wrote to memory of 2196	2268	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b552a4d89979a783e5e8a74b711ae41223302f7e0738ea02c39f9cd14dd3fb8a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2268 -s 160
  2⤵
  PID:2196