88857e9b86f9b14f89d6aa2f5df0724856c1fef02e941248e6cf4648aefc851f

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20-02-2024 18:46

Target

88857e9b86f9b14f89d6aa2f5df0724856c1fef02e941248e6cf4648aefc851f.dll
Size

1.2MB
MD5

cc690015d5d97343ce59361fcae38ed4
SHA1

7f04aca2248a351d2b2f640eea7e8515e70cddb0
SHA256

88857e9b86f9b14f89d6aa2f5df0724856c1fef02e941248e6cf4648aefc851f
SHA512

17840049e29324e893d2c428375ebb5aa6b73f2f08f5fbee7092d11da7ee0b38d1bfbd50996f32b90041b023a40d03289a689d6dbf305f85d1a8725ebbbf20d9
SSDEEP

24576:hLSd9kmW5Z/0L2s/lOvZm/K0s56BWIVMyaaO2HrOBV8eFc2zJdhWjtQJ:Kv51/lmasFxFmtg

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1448	1736	rundll32.exe	28
PID 1736 wrote to memory of 1448	1736	rundll32.exe	28
PID 1736 wrote to memory of 1448	1736	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\88857e9b86f9b14f89d6aa2f5df0724856c1fef02e941248e6cf4648aefc851f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1736 -s 84
  2⤵
  PID:1448