fade96ec359474962f2167744ca8c55ab4e6d0700faa142b3d95ec3f4765023b

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-04-2024 15:37

Target

fade96ec359474962f2167744ca8c55ab4e6d0700faa142b3d95ec3f4765023b.dll
Size

195KB
MD5

b0729083052b407de643abf78f712058
SHA1

7482dd986923b164f2715eb02eafbedddf545479
SHA256

fade96ec359474962f2167744ca8c55ab4e6d0700faa142b3d95ec3f4765023b
SHA512

603771acb11468d51f589d8bdc6e446a61cae65335bb5fc34c70767ef924280e5fb06650dac3ae8d04a22de5a0e552cef85a18b114cd708715e8e2a5a0299acf
SSDEEP

6144:UqX9aQTGvkTzwIdMDf6kiKRTeyohAIeQ5S0:UqxavV2KRLoeIeQ5d

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\windows\debug.dat	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2372	1972	rundll32.exe	28
PID 1972 wrote to memory of 2372	1972	rundll32.exe	28
PID 1972 wrote to memory of 2372	1972	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fade96ec359474962f2167744ca8c55ab4e6d0700faa142b3d95ec3f4765023b.dll,#1
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1972 -s 176
  2⤵
  PID:2372