40de45ea45d352703a19c4a5b07013c5e748d831e9f67111a776566463c0fbd3

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-04-2024 10:33

Target

40de45ea45d352703a19c4a5b07013c5e748d831e9f67111a776566463c0fbd3.dll
Size

183KB
MD5

4ee3fb2aba3b82171e6409e253bdddb5
SHA1

f5112f83885f2ede5d648224f18d78c5e70b9493
SHA256

40de45ea45d352703a19c4a5b07013c5e748d831e9f67111a776566463c0fbd3
SHA512

9a1c134c906eb85b6802edba37074cae7b5057d15f368937c075920b001ed1491004c1b021ba0bdf8e01d13398d96ae68f5b9968d4a7bc2614d9b83a758ac6e4
SSDEEP

3072:P9031LWaYenq+cAljU4edllrXsYsT4iK9JG1yy59thOpQc:161LOenq+cSoJXCThK12

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 1072	1692	rundll32.exe	28
PID 1692 wrote to memory of 1072	1692	rundll32.exe	28
PID 1692 wrote to memory of 1072	1692	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40de45ea45d352703a19c4a5b07013c5e748d831e9f67111a776566463c0fbd3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1692 -s 84
  2⤵
  PID:1072