db9b23ec9915fe3fc09e85339d42601e1395d0ed6d6e0586c0abd0dabe74cd64

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 04:08

Target

db9b23ec9915fe3fc09e85339d42601e1395d0ed6d6e0586c0abd0dabe74cd64.dll
Size

132KB
MD5

859a158964c238032b64e1b5f9143622
SHA1

83e4d6b8ce48cc1390d98a4e5ba6557fdd309b70
SHA256

db9b23ec9915fe3fc09e85339d42601e1395d0ed6d6e0586c0abd0dabe74cd64
SHA512

d575268f6c1654eec0c66a83c2d21ac5870d5c8e67c7f2446a0089ac6df9779925a7772a31cc28b3b57d211dcd231b72efa5f94ec19de3a0854a649c40a98c2c
SSDEEP

1536:8FBLUo8M/QPYC0B99gbNhugMS5i1bUiIfD027X2OZ5Jev04sWusd09dlYcbcMv6b:wGo8MYmB99SrtM0ieiG0275M8mMu0cM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 1740	2136	rundll32.exe	28
PID 2136 wrote to memory of 1740	2136	rundll32.exe	28
PID 2136 wrote to memory of 1740	2136	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\db9b23ec9915fe3fc09e85339d42601e1395d0ed6d6e0586c0abd0dabe74cd64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2136 -s 100
  2⤵
  PID:1740

memory/2136-1-0x0000000037760000-0x0000000037770000-memory.dmp

Filesize
64KB

Download
memory/2136-0-0x000007FEBE100000-0x000007FEBE110000-memory.dmp

Filesize
64KB

Download
memory/2136-2-0x0000000077771000-0x0000000077772000-memory.dmp

Filesize
4KB

Download
memory/2136-3-0x0000000077720000-0x00000000778C9000-memory.dmp

Filesize
1.7MB

Download
memory/2136-4-0x0000000077720000-0x00000000778C9000-memory.dmp

Filesize
1.7MB

Download
memory/2136-5-0x00000000FF540000-0x00000000FF54F000-memory.dmp

Filesize
60KB

Download