80abc14026ede9a9d0b601f925dfed172e6443eb20c63786866760395b1cb79b

Analysis

max time kernel
140s
max time network
127s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 17:01

Target

libADM_core.dll
Size

53KB
MD5

d7c30bf4445283c85edee4a43c67b821
SHA1

65ff84a09a9352591d5686188a199645942d9f1e
SHA256

3148665bd0bdea62bfb518aa3b45f709632db88181dc6abc088a80df80d46838
SHA512

1ecb5e512ccc314ff2cc7c8a20c2b9fc15725acc088b8676d4d65c9e06559856e43dc8343f1330e1a16eadd6d3531623ce0bc33a480262c9cae042636b1b5cb0
SSDEEP

768:8+hhRnYK2E8ahknydsFSaLLhVmkvz0tU+pJPB1UQzNnCz0noLkBzRyW6I3HybdW+:blnYAHwPEJPgk9rzcWPSdhB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 400	1516	rundll32.exe	28
PID 1516 wrote to memory of 400	1516	rundll32.exe	28
PID 1516 wrote to memory of 400	1516	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libADM_core.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1516 -s 132
  2⤵
  PID:400

memory/1516-0-0x0000000065100000-0x0000000065115000-memory.dmp

Filesize
84KB

Download
memory/1516-1-0x0000000063180000-0x000000006319C000-memory.dmp

Filesize
112KB

Download
memory/1516-2-0x000000006A5C0000-0x000000006A6FC000-memory.dmp

Filesize
1.2MB

Download
memory/1516-3-0x0000000069280000-0x0000000069293000-memory.dmp

Filesize
76KB

Download