23959954af5f41d4f6ce084e0a2a6f60eb54a9f53665c7fe6002e58a467694de

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12-01-2024 23:02

Target

23959954af5f41d4f6ce084e0a2a6f60eb54a9f53665c7fe6002e58a467694de.dll
Size

104KB
MD5

865ce075cce792e78ff5e291d9d04ef3
SHA1

fd693a5ca7fdff54698132e0e96e25d724c7b2cb
SHA256

23959954af5f41d4f6ce084e0a2a6f60eb54a9f53665c7fe6002e58a467694de
SHA512

4c520e8345fa6f16e8baec442a0bb7f3f99155d70362cc8bab62cb2bd9ab80cb37d435e8a0b76c2be24171c729dd06cc008a7a80c4297bc177754eaf0190872f
SSDEEP

3072:xPJV4GGcvsOr8H8WZwm1W1k1ahrczJkq1uM:CGt1wclZNyiq1u

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2644	2372	rundll32.exe	28
PID 2372 wrote to memory of 2644	2372	rundll32.exe	28
PID 2372 wrote to memory of 2644	2372	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\23959954af5f41d4f6ce084e0a2a6f60eb54a9f53665c7fe6002e58a467694de.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2372 -s 132
  2⤵
  PID:2644