646856654c85c9e3404fb969bc65366080ad69ffa63d288d32f9ab71c4b2574b

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14-02-2024 11:15

Target

646856654c85c9e3404fb969bc65366080ad69ffa63d288d32f9ab71c4b2574b.dll
Size

1.2MB
MD5

6c22795dd5cf4455da5644b266612c89
SHA1

9cce93fae11bf01ff16ce0e296270a419de9234e
SHA256

646856654c85c9e3404fb969bc65366080ad69ffa63d288d32f9ab71c4b2574b
SHA512

6a6bc96358a6a3c6c171b6b327de03dfecac003c0646a253d186dd6e98c0a774c798103692574b96ba9972feb5f340924fa06b9446efef4409dd5052eed46310
SSDEEP

24576:f/AxL2HrN03HVkLI/LcnghFdk57CpCK/VrQtkEE9UYYkvzp:mwYI2wghc5q/GtkEAsKp

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 1728	2112	rundll32.exe	28
PID 2112 wrote to memory of 1728	2112	rundll32.exe	28
PID 2112 wrote to memory of 1728	2112	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\646856654c85c9e3404fb969bc65366080ad69ffa63d288d32f9ab71c4b2574b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2112 -s 84
  2⤵
  PID:1728