f53a8da661e5b544b6d95f08620cd922fd0fe828cf95655654367dbf0ddbd9b4

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 10:30

Target

f53a8da661e5b544b6d95f08620cd922fd0fe828cf95655654367dbf0ddbd9b4.dll
Size

1.2MB
MD5

f2935a4e64424b82da90108e631e0e40
SHA1

225f2d86db5959c44f6b9ce748b3524aefc71004
SHA256

f53a8da661e5b544b6d95f08620cd922fd0fe828cf95655654367dbf0ddbd9b4
SHA512

cf81bdddce47dabddf8ed183d39f2cc9a533e7fb364052045b4773d8b22c749eb3b11413b71af2d2a402377bbeae031944aa3aba1b3d013090e48b962aa6b1f4
SSDEEP

24576:OSqXRxnyx/JQw1Gj4Q68Z9Op8Ve6V7dkiVEYJFqpQHTbBsrSOJra7M5oD:O5I3EU+sWVdV7dk6US4ag2D

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2220	2236	rundll32.exe	30
PID 2236 wrote to memory of 2220	2236	rundll32.exe	30
PID 2236 wrote to memory of 2220	2236	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f53a8da661e5b544b6d95f08620cd922fd0fe828cf95655654367dbf0ddbd9b4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2236 -s 84
  2⤵
  PID:2220