931e2dd9731c1b5fd13ad6eece53fc5570928296402ccabdc29fb7dd3d986cf6

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 22:25

Target

931e2dd9731c1b5fd13ad6eece53fc5570928296402ccabdc29fb7dd3d986cf6.dll
Size

1.2MB
MD5

f42112c4f68e2ffc2ddb94073079358c
SHA1

abc9314c2135e12372ace709b17bd25912c48ad8
SHA256

931e2dd9731c1b5fd13ad6eece53fc5570928296402ccabdc29fb7dd3d986cf6
SHA512

ec8d111ac9355c28d7e1453fcd618e5627cdf6ef7728e5f209b697d2f25acfaf3f48ce9cb8fcf932b790b8ca3d47a9f37a84b7ad00bc07a188618be67446f274
SSDEEP

24576:V88Kjwqgo6dmg6XKZz0AUfOwZbB2aBnRLI151E/BgXRzyCF7z7v8:u7+ZU3TODE/CdP8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2112	1904	rundll32.exe	28
PID 1904 wrote to memory of 2112	1904	rundll32.exe	28
PID 1904 wrote to memory of 2112	1904	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\931e2dd9731c1b5fd13ad6eece53fc5570928296402ccabdc29fb7dd3d986cf6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1904 -s 84
  2⤵
  PID:2112