034cdda3015d25d745532d8a51bf4315fc26a0324b9d17f4c5189634229c56f0

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 20:04

Target

034cdda3015d25d745532d8a51bf4315fc26a0324b9d17f4c5189634229c56f0.dll
Size

1.2MB
MD5

e7a6a265e0a7001755bf3321e73ff79d
SHA1

84bbea554c6154bdaba2062b6c6f2d24f412eaf1
SHA256

034cdda3015d25d745532d8a51bf4315fc26a0324b9d17f4c5189634229c56f0
SHA512

bb055b81f491bac72c5e17b5116b58fde0ff630932f504e030e710e97d8456588dda9da55b214a0eb4f9b2c29c86821eea65ae731d2f36e3338fc12057007649
SSDEEP

24576:bDuxKmI0rJwMcB7T/HEbLtg25N9n9usMlBk1aIurzG+lbGzZrxGNV6IOfTEB:x1dTvEHtr5N94Zpu9wXmEB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2348	2192	rundll32.exe	28
PID 2192 wrote to memory of 2348	2192	rundll32.exe	28
PID 2192 wrote to memory of 2348	2192	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\034cdda3015d25d745532d8a51bf4315fc26a0324b9d17f4c5189634229c56f0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2192 -s 80
  2⤵
  PID:2348