f702dfddbc5b4f1d5a5a9db0a2c013900d30515e69a09420a7c3f6eaac901b12

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 14:59

Target

f702dfddbc5b4f1d5a5a9db0a2c013900d30515e69a09420a7c3f6eaac901b12.dll
Size

2.6MB
MD5

b693e3d2f2cab550ad4f8c5722776498
SHA1

6dc93db10d46cf777f9928803157dd16dc097e79
SHA256

f702dfddbc5b4f1d5a5a9db0a2c013900d30515e69a09420a7c3f6eaac901b12
SHA512

d5c02150265ab6d5d2d6a6e39514b345f6108afaecfd0d8e196b0b99d6d1af36245eb12e8a6879f16b619ba89f8eec442c394eff5f6298d1534c9f0084d63f18
SSDEEP

49152:xL+qLntVtOg3gJjW4UeJiGew5o/ylRbUlo60bNBUDXVFhIECIpuXo+kY8ss:tHnsg3gZHUeANwl6SuF+SFss

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 1148	2108	rundll32.exe	28
PID 2108 wrote to memory of 1148	2108	rundll32.exe	28
PID 2108 wrote to memory of 1148	2108	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f702dfddbc5b4f1d5a5a9db0a2c013900d30515e69a09420a7c3f6eaac901b12.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2108 -s 92
  2⤵
  PID:1148