40bf8bbfd4a65ccef80ddbfde08db236c7f4e20e4e4f1431960a1f14005be734

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 18:19

Target

40bf8bbfd4a65ccef80ddbfde08db236c7f4e20e4e4f1431960a1f14005be734.dll
Size

1.2MB
MD5

5e58e058aba24c30be9eaff700de217f
SHA1

59e6d6de144dd596fda80cf32877bce518f9ed0b
SHA256

40bf8bbfd4a65ccef80ddbfde08db236c7f4e20e4e4f1431960a1f14005be734
SHA512

e15585f62d022f1be3cf762537e7903a7def247f73dc45bfc7779ade21d5913b8d23fd7c6330ee6f32a491ce9f39193b4c092e3b3fe7e23d159bdfd91ad8c1ad
SSDEEP

24576:lwOhCPykWGGrYL1hb4LPRAMXLXuw2tL0IGrkNBxgvx3FWlDe:9TKhL4LP+AMtBoAe

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 2992	2816	rundll32.exe	14
PID 2816 wrote to memory of 2992	2816	rundll32.exe	14
PID 2816 wrote to memory of 2992	2816	rundll32.exe	14

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2816 -s 80
1⤵
PID:2992

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40bf8bbfd4a65ccef80ddbfde08db236c7f4e20e4e4f1431960a1f14005be734.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2816