20d91430397028cb83296e7a41598414c9a4ef272afba435196d231a8cbd0b67

Analysis

max time kernel
120s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18-01-2024 03:51

Target

api-ms-win-core-debug-l1-1-0.dll
Size

18KB
MD5

8c0531639f58f79b5b67b52edebb01bd
SHA1

866f3ca8819440e0ba67eb935e688509f86ce1e3
SHA256

a20dc11ab10769b38cafb701c2d08810c8aa61350f0b33ae7838ff5c26edf956
SHA512

d6ddcb814d7f507df03bd5fb378eae3bf30f31d0cbb41136382469297033965763dc20e68dc50108eeb5fb5996d167cf21b29dbdc0ea163521607e1cc75f7d9a
SSDEEP

192:1WfhWweivT16uDBks/nGfe4pBjS72Ek7KHwDoG8WebtuVaVWQ4+WoRmqnajiPNQJ:1WfhWqvT1Nq0GftpBjGmKQDcZZ8lgeL1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2196	2876	rundll32.exe	28
PID 2876 wrote to memory of 2196	2876	rundll32.exe	28
PID 2876 wrote to memory of 2196	2876	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-core-debug-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2876 -s 84
  2⤵
  PID:2196