816be49bf181dc68306dd73e7ad1ae99a56e95e0c28959f782e1fdd70004d105

Analysis

max time kernel
143s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/12/2023, 05:26

Target

816be49bf181dc68306dd73e7ad1ae99a56e95e0c28959f782e1fdd70004d105.dll
Size

68KB
MD5

c84c7ade9d53d0520ff6949d2f7fac91
SHA1

b9e59fc00bc3669a53da66e155ea64e2ea373f98
SHA256

816be49bf181dc68306dd73e7ad1ae99a56e95e0c28959f782e1fdd70004d105
SHA512

9b0520aad07ab6d5984f9fe285dbc50a92807e8e3f148f62c9ca66759cc4e3c28d48f654a9877b889db57757d8aeaee9a1e8e77daa6627e94655ebc55072fdb6
SSDEEP

384:IM3osalauShe3/selrr47Vh8QaxNyey0S6xJrs7sL/M78qhwq2kvp8YO:IM5aShKsAr8laxNvrls+0e

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2032	1964	rundll32.exe	28
PID 1964 wrote to memory of 2032	1964	rundll32.exe	28
PID 1964 wrote to memory of 2032	1964	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\816be49bf181dc68306dd73e7ad1ae99a56e95e0c28959f782e1fdd70004d105.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1964 -s 96
  2⤵
  PID:2032

memory/1964-0-0x000007FEFAF30000-0x000007FEFAF42000-memory.dmp

Filesize
72KB

Download