d59218dbf2b8a182165b80d1cd122b596e9af9ed720158a6fb7e8a28325446f9

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/02/2024, 08:57

Target

d59218dbf2b8a182165b80d1cd122b596e9af9ed720158a6fb7e8a28325446f9.dll
Size

1.2MB
MD5

697b8795bca17ffbc01f5f621fcc489f
SHA1

d4dbbc991eff00a2558061aebbd30a2d8fc90ea4
SHA256

d59218dbf2b8a182165b80d1cd122b596e9af9ed720158a6fb7e8a28325446f9
SHA512

6a0727d28333429e747adcde7c182b8212a81aa6ad12c515a15a6643b9bada3bf6b8f42e88a11a818beb497a4fea945ab8128b3346a8b784153513f564fc1d8c
SSDEEP

24576:UDcEKh1b+t2rVumJqHhWdgGzjNwT2t/OMgy/IgokjpkVb404EyIaNedW:EmdjJqWgMjEOQVVsMyIaEW

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 1716	2196	rundll32.exe	28
PID 2196 wrote to memory of 1716	2196	rundll32.exe	28
PID 2196 wrote to memory of 1716	2196	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d59218dbf2b8a182165b80d1cd122b596e9af9ed720158a6fb7e8a28325446f9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2196 -s 84
  2⤵
  PID:1716