e8f18a59a3c4a7b9d8f00c203d1c3cecb8b2353d79ba6546e78084796e36f56f

Resubmissions

23-02-2024 14:34

25-01-2024 16:04

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 16:04

Target

bin/cdt.dll
Size

24KB
MD5

c5f6c280750ebfa566cddea5ca13e8cd
SHA1

9611cf6620fc3391f4790f647103725bb7e1656b
SHA256

c840bfab79c2d707688bdda7da41ed6d2a830a63d4df6775af45d52c6ef04551
SHA512

d633890f1bfc1db9442cef199198f36c070d1527a816dc7ad0ef9b2ec6d3f3681346ff01741c0cabdd097603c1d970ae153eb4bf4fd1864c4dbfc95abd6425c7
SSDEEP

384:z32N/c5ZvZoeXGPDYIHMivGuAPXo4r4IyF3Ed/rAvrXREMm6JqJOCEIzio9ZNWB:X5Z2PsApIE0dUvrXRfqcrIzio9C

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1044 wrote to memory of 2376	1044	rundll32.exe	WerFault.exe
PID 1044 wrote to memory of 2376	1044	rundll32.exe	WerFault.exe
PID 1044 wrote to memory of 2376	1044	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\cdt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1044

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1044 -s 80
2⤵
PID:2376