1eb013845285d8f562cfef864c7444baaca59c3f3b86142580eccd76d4ba1392

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-04-2024 04:43

Target

1eb013845285d8f562cfef864c7444baaca59c3f3b86142580eccd76d4ba1392.dll
Size

1.8MB
MD5

aaa356c85c55cd972a71418211573f12
SHA1

6def0baaa410f65e5160379d1c9ad07f51fa9f92
SHA256

1eb013845285d8f562cfef864c7444baaca59c3f3b86142580eccd76d4ba1392
SHA512

6577c72bfe440512f4ebb36ce7b2102747afe0534860e7f483ec2809d03aa52f0488be999df9f519f713093f8de65c6f5ed0249c7d82c1b665f21f3d39505b6b
SSDEEP

6144:EjgS4uezAc1NdJ10+sn51mluNgERgR0IDdCeo4gf+UsTr2iRM2QF68tZn:oA1J1IDlaSi+2v8tB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2228	1756	rundll32.exe	28
PID 1756 wrote to memory of 2228	1756	rundll32.exe	28
PID 1756 wrote to memory of 2228	1756	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1eb013845285d8f562cfef864c7444baaca59c3f3b86142580eccd76d4ba1392.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1756 -s 80
  2⤵
  PID:2228