7e633aabe1b11be25c3f51accb272d25857bfa8fe35788fbc33e5c1952456248

Analysis

max time kernel
149s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 14:31

Target

Baggrundsviden/vtablog.dll
Size

268KB
MD5

35119e61479373ba5d7433f106556e79
SHA1

096a7d227eb2514d76ec5d10bfd1cf165d4a9177
SHA256

f21d9de02c67e51bb9f7163f676f2d4710b2befae04fd0751a63cf1278c48a3c
SHA512

21318d0924393c8269419df5acc0c07ca2f754fd9d9ad80d393cf7ebec1b16986d123f2775ae210383b7faa106ed84e829c949004a123da844c07f2b46387453
SSDEEP

3072:s1vaCg+eY9yp71driAAYBnk/+eeaQyJen3n83fucakiD88iryUBw:ovDgZYq/rzfNufuceD5UBw

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1724 wrote to memory of 2368	1724	rundll32.exe	WerFault.exe
PID 1724 wrote to memory of 2368	1724	rundll32.exe	WerFault.exe
PID 1724 wrote to memory of 2368	1724	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Baggrundsviden\vtablog.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1724 -s 84
2⤵
PID:2368

memory/1724-0-0x000007FEF6C30000-0x000007FEF6C78000-memory.dmp

Filesize
288KB

Download