235daecd433f8ea43d30cf3dcc80fbd41fa7bc750e37c039c734c213d8ffe4e2

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 12:03

Target

235daecd433f8ea43d30cf3dcc80fbd41fa7bc750e37c039c734c213d8ffe4e2.dll
Size

1.3MB
MD5

d7eb833804879632dc09c80b03088295
SHA1

04da902c5fbed0df6eaf6671e102585b0c0768b7
SHA256

235daecd433f8ea43d30cf3dcc80fbd41fa7bc750e37c039c734c213d8ffe4e2
SHA512

cbadb14e9d3f2812c19a4f5a5371834ba102eac0e1dac76730573742fcebf6ddcc2c84d471ebd1e37d01e307de9b015e9cc90da93294a7286dece7ded361ca89
SSDEEP

24576:D8kyQxSNAZHjxrjIiUqaCli6ZhSnnVH0vuHMyBxRzSj7EK25KAhawW:AkbSNoHjxvIiU8l2VeUM+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2296	3016	rundll32.exe	28
PID 3016 wrote to memory of 2296	3016	rundll32.exe	28
PID 3016 wrote to memory of 2296	3016	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\235daecd433f8ea43d30cf3dcc80fbd41fa7bc750e37c039c734c213d8ffe4e2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3016 -s 84
  2⤵
  PID:2296