c189d6a237ab9447d94759158933cc55d0906c7501aec0c185c2f5c583430025

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 14:24

Target

winhttp.dll
Size

20KB
MD5

88fcbe634fe023a020fe533814da7840
SHA1

e8b893a658c706b8f471ce7d5b63eccb9248b605
SHA256

5d357d0a27703eaf97a7474dc08179846e874a045b18ed6048d19e15fd663295
SHA512

7e0c5601e29b2783d45b08b32f9c7166588ae8d25479da38c0b060d749aed79749434bae03dd59a6fd82a24e32fa5f5d4baeca123722a08fbfb811003bb0eb24
SSDEEP

384:VdYThhjc6dJJt5QpUbx3FgT43gYmDsC1fxgKTmkUIEmckVPxIiT75oc+c:VuNh4iJt5MAFI4OsC1fxgKTsrmckVPxY

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1664	1972	rundll32.exe	28
PID 1972 wrote to memory of 1664	1972	rundll32.exe	28
PID 1972 wrote to memory of 1664	1972	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\winhttp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1972 -s 112
  2⤵
  PID:1664