6bd6cd1c6bcfe0790fc8f5d50afa96c0b0d300c823952d98c68154e178bc5083

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/01/2024, 18:44

Target
x86/api-ms-win-core-synch-l1-1-0.dll
Size 19KB
Sample240122-xdf9bschc2
SHA256 8bb38a7a59fbaa792b3d5f34f94580429588c8c592929cbd307afd5579762abc
MD5 979c67ba244e5328a1a2e588ff748e86
SHA1 4c709ce527550eb7534cb6362afdb3623c98254e
SHA512 49f3c3319aa462b445c6a0b816e10034f6e5a9cf1250ea30b348cfa1ef71525e9f62e2f13253f61375f51fc574847de0d509cffa95103771be356327d5fef90d
SSDEEP 384:Wjdv3V0dfpkXc0vVaCWfhWt+Y3DGk8ZpH3GCJErHZpn+Y3DGUrUN8JN77hhYl:Wdv3VqpkXc0vVabkDGkiRBEtplDGEUq8
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 1352	1568	rundll32.exe	28
PID 1568 wrote to memory of 1352	1568	rundll32.exe	28
PID 1568 wrote to memory of 1352	1568	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\api-ms-win-core-synch-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1568 -s 84
  2⤵
  PID:1352