2b29b24f2a311158a4900bddf41fe482c42e46941a42468b4990fd467fde5f72

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-01-2024 11:06

Target

Galvanoteknikken/vtablog.dll
Size

268KB
MD5

35119e61479373ba5d7433f106556e79
SHA1

096a7d227eb2514d76ec5d10bfd1cf165d4a9177
SHA256

f21d9de02c67e51bb9f7163f676f2d4710b2befae04fd0751a63cf1278c48a3c
SHA512

21318d0924393c8269419df5acc0c07ca2f754fd9d9ad80d393cf7ebec1b16986d123f2775ae210383b7faa106ed84e829c949004a123da844c07f2b46387453
SSDEEP

3072:s1vaCg+eY9yp71driAAYBnk/+eeaQyJen3n83fucakiD88iryUBw:ovDgZYq/rzfNufuceD5UBw

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1904 wrote to memory of 2036	1904	rundll32.exe	WerFault.exe
PID 1904 wrote to memory of 2036	1904	rundll32.exe	WerFault.exe
PID 1904 wrote to memory of 2036	1904	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Galvanoteknikken\vtablog.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1904 -s 80
  2⤵
  PID:2036

memory/1904-0-0x000007FEF7E00000-0x000007FEF7E48000-memory.dmp

Filesize
288KB

Download