49af717ec15e64b6d7b2f269fc84dccc1ddbe400611eb6b6bdc429674d4561ff

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06-02-2024 15:24

Target

Baggrundsviden/vtablog.dll
Size

268KB
MD5

35119e61479373ba5d7433f106556e79
SHA1

096a7d227eb2514d76ec5d10bfd1cf165d4a9177
SHA256

f21d9de02c67e51bb9f7163f676f2d4710b2befae04fd0751a63cf1278c48a3c
SHA512

21318d0924393c8269419df5acc0c07ca2f754fd9d9ad80d393cf7ebec1b16986d123f2775ae210383b7faa106ed84e829c949004a123da844c07f2b46387453
SSDEEP

3072:s1vaCg+eY9yp71driAAYBnk/+eeaQyJen3n83fucakiD88iryUBw:ovDgZYq/rzfNufuceD5UBw

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2192 wrote to memory of 1720	2192	rundll32.exe	WerFault.exe
PID 2192 wrote to memory of 1720	2192	rundll32.exe	WerFault.exe
PID 2192 wrote to memory of 1720	2192	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Baggrundsviden\vtablog.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2192

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2192 -s 80
2⤵
PID:1720

memory/2192-0-0x000007FEF73A0000-0x000007FEF73E8000-memory.dmp

Filesize
288KB

Download