b8a5f88f60837143f18dd1494a7195ac283b91d068668d1d34b4994a8148641c

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-01-2024 11:06

Target

Opprioriter/Brugerinterface/Belbsfeltet/Algores/vtablog.dll
Size

268KB
MD5

35119e61479373ba5d7433f106556e79
SHA1

096a7d227eb2514d76ec5d10bfd1cf165d4a9177
SHA256

f21d9de02c67e51bb9f7163f676f2d4710b2befae04fd0751a63cf1278c48a3c
SHA512

21318d0924393c8269419df5acc0c07ca2f754fd9d9ad80d393cf7ebec1b16986d123f2775ae210383b7faa106ed84e829c949004a123da844c07f2b46387453
SSDEEP

3072:s1vaCg+eY9yp71driAAYBnk/+eeaQyJen3n83fucakiD88iryUBw:ovDgZYq/rzfNufuceD5UBw

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1944 wrote to memory of 3056	1944	rundll32.exe	WerFault.exe
PID 1944 wrote to memory of 3056	1944	rundll32.exe	WerFault.exe
PID 1944 wrote to memory of 3056	1944	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Opprioriter\Brugerinterface\Belbsfeltet\Algores\vtablog.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1944 -s 84
  2⤵
  PID:3056

memory/1944-0-0x000007FEF7E40000-0x000007FEF7E88000-memory.dmp

Filesize
288KB

Download