f80829d30029ba255675929587f2b6665de2790e52b24845b92d1427c8893264

Analysis

max time kernel
260s
max time network
320s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-02-2024 20:32

Target

hb.dll
Size

66.1MB
MD5

d3f0f312725a18d683820cd9def15860
SHA1

521a515d3683e4c37500fcd6576aa19bffa0e512
SHA256

0af40481a7c392c68069b1a8c225beb3e7062760131ae09bad467d84b09c1862
SHA512

08a346c13f9c602e8ff51c3f461dc9002dc5ac1f16e975e53f39e094d9fa7f7934e7ef63daaedf10d0524b80308dd6ee792e706b3999cafa0fd07ce4f76ce2e0
SSDEEP

393216:trqy505Di6M+Ak+rymPyujJ6ze7jyIoPkoQBgTgrti6o0rYEtHTghJL5FR0J2KBg:trV6M+Ak+GRWjyItng8YGmNFWv/dZw

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 1300	1544	rundll32.exe	27
PID 1544 wrote to memory of 1300	1544	rundll32.exe	27
PID 1544 wrote to memory of 1300	1544	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1544 -s 188
  2⤵
  PID:1300

memory/1544-0-0x000007FEE0CD0000-0x000007FEE6699000-memory.dmp

Filesize
89.8MB

Download