e98d8ae395ec7d2bbc29c21fa2bf79e26ada9d8bd5098487027b32aeae8b03b7

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 21:38

Target

e98d8ae395ec7d2bbc29c21fa2bf79e26ada9d8bd5098487027b32aeae8b03b7.dll
Size

199KB
MD5

213968cd30fd6811d8c5a530d326e03f
SHA1

ca4f01f99f96cc62e495957fd13a35a7f8cf38b2
SHA256

e98d8ae395ec7d2bbc29c21fa2bf79e26ada9d8bd5098487027b32aeae8b03b7
SHA512

24af2aa4c75d560427ad0253753c56da29845d5aabb360452cfd8485d047a25817ef2d8d32b58ef337e36ad969d5b5e36cca604313de17f9316089d31e440892
SSDEEP

6144:oN/CFTJsu5TMvj04Z/X0dTcDoRTe4ohfc5SUk:oNmiugfPoRdoa5A

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\windows\debug.dat	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 1824	2388	rundll32.exe	28
PID 2388 wrote to memory of 1824	2388	rundll32.exe	28
PID 2388 wrote to memory of 1824	2388	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e98d8ae395ec7d2bbc29c21fa2bf79e26ada9d8bd5098487027b32aeae8b03b7.dll,#1
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2388 -s 188
  2⤵
  PID:1824