a7d828114afe50098a9037253b928bf372ef31ec1fa7ad16e5c19fd9cb1aedfe

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 02:27

Target

a7d828114afe50098a9037253b928bf372ef31ec1fa7ad16e5c19fd9cb1aedfe.dll
Size

1.7MB
MD5

7a5b3c322f5c3fc95bfbc4ec7fdcce4b
SHA1

92cd2222a2e4396c53aec69746619781f27381aa
SHA256

a7d828114afe50098a9037253b928bf372ef31ec1fa7ad16e5c19fd9cb1aedfe
SHA512

c0e2551fcb0e27cf98664d729461da513e4ee86b621985887e2499068fca375fc6936164d5a192bffc6dec235fda76779608912709c26fbcd2eac9670ee81ab1
SSDEEP

24576:btIhn1ekjXT6m8lGgQAxx9hmWTUbZ3rJlCdmuoyBh12zq:xIh0WevlwGjH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2108	1732	rundll32.exe	28
PID 1732 wrote to memory of 2108	1732	rundll32.exe	28
PID 1732 wrote to memory of 2108	1732	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a7d828114afe50098a9037253b928bf372ef31ec1fa7ad16e5c19fd9cb1aedfe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1732 -s 200
  2⤵
  PID:2108

memory/1732-0-0x0000000001EB0000-0x0000000002063000-memory.dmp

Filesize
1.7MB

Download
memory/1732-1-0x0000000001EB0000-0x0000000002063000-memory.dmp

Filesize
1.7MB

Download