6c8b2d238fd8b62ad29fbd8dcf173953bedbdb2c54af554333b4ebaafc3631fb

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 04:06

Target

6c8b2d238fd8b62ad29fbd8dcf173953bedbdb2c54af554333b4ebaafc3631fb.dll
Size

2.3MB
MD5

fa5609f36bc3fc02ddac994f5756f039
SHA1

02186dc26562ed3558f0f7e7b4b77aecf3a93219
SHA256

6c8b2d238fd8b62ad29fbd8dcf173953bedbdb2c54af554333b4ebaafc3631fb
SHA512

87c3789326a5ff6924843c31ae27c4b6e01389d874c54bd4d3cd55ce1c303ea067582462dc925520e2d7a85cdf8eeed4fac1e8a7d4a95abc18673bacdab3c30d
SSDEEP

49152:kxn7xXTlWCQ5Ky40LKG6mCkZw1Z+Qz1HZTK8pvFxOE7UT0inC5:kg5JF6zz1HZTlz7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 3016	2344	rundll32.exe	17
PID 2344 wrote to memory of 3016	2344	rundll32.exe	17
PID 2344 wrote to memory of 3016	2344	rundll32.exe	17

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c8b2d238fd8b62ad29fbd8dcf173953bedbdb2c54af554333b4ebaafc3631fb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2344 -s 244
  2⤵
  PID:3016