4982294c6987abddef014bea2095b8afad143789fb35a6ee27e6ca9570018522

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 23:34

Target

4982294c6987abddef014bea2095b8afad143789fb35a6ee27e6ca9570018522.dll
Size

16KB
MD5

b2f4a69100a14c006d32da478877607c
SHA1

aa2dcfd016096eb88f9da4c8189266c3a7f32d10
SHA256

4982294c6987abddef014bea2095b8afad143789fb35a6ee27e6ca9570018522
SHA512

74c18bba30fad4fda632bc2adf55d3f5a4b2a22db2987f069c7a2abe8239b7ce46d7ec4d6a89cdf834a8f2941bbc05c250ed446dcf2694a0ae51dfbfc38b534b
SSDEEP

384:b/fSN9v5X13j+Ftrv+tzzJNXooywNhPlBAuEP:b3SN9vl1qFNv+tnzjy8h+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2744	1848	rundll32.exe	28
PID 1848 wrote to memory of 2744	1848	rundll32.exe	28
PID 1848 wrote to memory of 2744	1848	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4982294c6987abddef014bea2095b8afad143789fb35a6ee27e6ca9570018522.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1848 -s 84
  2⤵
  PID:2744