006c3e59e32dc5f56cfa6b911e4e4fc171d681e614f3ec48edf232460814d31f

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22/01/2024, 18:44

Target

x86/api-ms-win-core-rtlsupport-l1-1-0.dll
Size

17KB
MD5

0069fd29263c0dd90314c48bbce852ef
SHA1

dfb99c850a69e67e85f0a0985659f325bd8f84fc
SHA256

d11093fdc1d5c9213b9b2886ce91db3ded17ef8dae1615a8c7ffbc55b8e3f79b
SHA512

71965e8dd2fd81d0c6dba4dbec8d2d1bfd4a644ef6bba4f6027de4bcdf9c07da16f27f2156c21b52e678c75f0a93a4bcbc3e1942f0a73f1eea5ff64b70662f70
SSDEEP

384:WCGeVxWfhWD+Y3DGk8ZpH3GCJErYtN+Y3DGUO8JN77hhTew:3GeVmyDGkiRBEojDGa3h9ew

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2956	2896	rundll32.exe	28
PID 2896 wrote to memory of 2956	2896	rundll32.exe	28
PID 2896 wrote to memory of 2956	2896	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\api-ms-win-core-rtlsupport-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2896 -s 80
  2⤵
  PID:2956