6c8b2d238fd8b62ad29fbd8dcf173953bedbdb2c54af554333b4ebaafc3631fb

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 03:41

Target

6c8b2d238fd8b62ad29fbd8dcf173953bedbdb2c54af554333b4ebaafc3631fb.dll
Size

2.3MB
MD5

fa5609f36bc3fc02ddac994f5756f039
SHA1

02186dc26562ed3558f0f7e7b4b77aecf3a93219
SHA256

6c8b2d238fd8b62ad29fbd8dcf173953bedbdb2c54af554333b4ebaafc3631fb
SHA512

87c3789326a5ff6924843c31ae27c4b6e01389d874c54bd4d3cd55ce1c303ea067582462dc925520e2d7a85cdf8eeed4fac1e8a7d4a95abc18673bacdab3c30d
SSDEEP

49152:kxn7xXTlWCQ5Ky40LKG6mCkZw1Z+Qz1HZTK8pvFxOE7UT0inC5:kg5JF6zz1HZTlz7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2628	2476	rundll32.exe	29
PID 2476 wrote to memory of 2628	2476	rundll32.exe	29
PID 2476 wrote to memory of 2628	2476	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c8b2d238fd8b62ad29fbd8dcf173953bedbdb2c54af554333b4ebaafc3631fb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2476 -s 252
  2⤵
  PID:2628