f80829d30029ba255675929587f2b6665de2790e52b24845b92d1427c8893264

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29-04-2024 04:52

Target

hb.dll
Size

66.1MB
MD5

d3f0f312725a18d683820cd9def15860
SHA1

521a515d3683e4c37500fcd6576aa19bffa0e512
SHA256

0af40481a7c392c68069b1a8c225beb3e7062760131ae09bad467d84b09c1862
SHA512

08a346c13f9c602e8ff51c3f461dc9002dc5ac1f16e975e53f39e094d9fa7f7934e7ef63daaedf10d0524b80308dd6ee792e706b3999cafa0fd07ce4f76ce2e0
SSDEEP

393216:trqy505Di6M+Ak+rymPyujJ6ze7jyIoPkoQBgTgrti6o0rYEtHTghJL5FR0J2KBg:trV6M+Ak+GRWjyItng8YGmNFWv/dZw

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2064	2352	rundll32.exe	28
PID 2352 wrote to memory of 2064	2352	rundll32.exe	28
PID 2352 wrote to memory of 2064	2352	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2352 -s 184
  2⤵
  PID:2064

memory/2352-0-0x000007FEDC970000-0x000007FEE2339000-memory.dmp

Filesize
89.8MB

Download