3597a8ee2fd791c9e92331f356ee4371ee62e1d88c319b69ad4be01b3fa0ddf3

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 13:29

Target

3597a8ee2fd791c9e92331f356ee4371ee62e1d88c319b69ad4be01b3fa0ddf3.dll
Size

1.2MB
MD5

90dd863ef3467fd470e065bc098859b9
SHA1

d598a0f8573bfeabe7a20084d951675c91c8469b
SHA256

3597a8ee2fd791c9e92331f356ee4371ee62e1d88c319b69ad4be01b3fa0ddf3
SHA512

3bc9ebc2578d3dcb36afe7e04744635655ddf16c4e51968dc53a871d18973ff8cbf3697509254511435e1f437ddb9259d16c60c1b5cf21c58a45bfd71a274a94
SSDEEP

24576:BJfz/STTtVoiytjbo49BKCfv3MryTP+ParA+cwMmPTjWw7cGvgcj:je7AnoqBfiglXW2Is

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2316	1848	rundll32.exe	28
PID 1848 wrote to memory of 2316	1848	rundll32.exe	28
PID 1848 wrote to memory of 2316	1848	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3597a8ee2fd791c9e92331f356ee4371ee62e1d88c319b69ad4be01b3fa0ddf3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1848 -s 84
  2⤵
  PID:2316