c45c2fd6607643fb14a7c3d09255e7a61ec2adc59b8f27f3237414d0ac479a6d

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 15:06

Target

c45c2fd6607643fb14a7c3d09255e7a61ec2adc59b8f27f3237414d0ac479a6d.dll
Size

1.2MB
MD5

6abec70e0eea8630acea0e0f3a00b0f6
SHA1

7aaed184a8bc1c1fd5f62c7b1637c02fd383f12c
SHA256

c45c2fd6607643fb14a7c3d09255e7a61ec2adc59b8f27f3237414d0ac479a6d
SHA512

173b916b19c34cf600e42af0c5df31ba01e49e705ef04a866df37205b9e9a0f3e7cd2f38b4eacf3d637984b6025189366f3ba1a6536ac5af48084a93c5ef6687
SSDEEP

24576:BJfz/STTtVoiytjbo49BKCfv3MryTP+ParA+cwMmPTjWw7cGvgcw:je7AnoqBfiglXW2IP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1712	1688	rundll32.exe	28
PID 1688 wrote to memory of 1712	1688	rundll32.exe	28
PID 1688 wrote to memory of 1712	1688	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c45c2fd6607643fb14a7c3d09255e7a61ec2adc59b8f27f3237414d0ac479a6d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1688 -s 80
  2⤵
  PID:1712