c0c017f18b0afe8d9fd84617fb87153ac2ffd01f93db2e9b13144f3e242277da

Analysis

max time kernel
19s
max time network
29s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 03:45

Target
Anvil.dll
Size 2.1MB
Sample240601-ea5teagg6w
SHA256 d2b535f223d7bddbb335bfc4ddc81cd54f167a91be4d346ffd43aef1d10f468d
MD5 a509a7a795ed21d4f5d8528c2d52af0e
SHA1 73428732db176586211c9a485b255182e11ea1bd
SHA512 6b429c1f00782cf3998e1b04fdf1fb64331e84b7753de38a35affd01c258e5ca5901bf50a8fc8ddc66e5d6f4209dbf18337eafed794ae293777c54c548ccc154
SSDEEP 24576:1m7J9hBA323TZZx0L48+ruptu2bOwg4GZKaEvoIx641L9byNvo5EHfhtKEtOjsCl:Id9E0Ty4tUJxlxyNASHfhUEfC
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2100	3020	rundll32.exe	28
PID 3020 wrote to memory of 2100	3020	rundll32.exe	28
PID 3020 wrote to memory of 2100	3020	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Anvil.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3020 -s 212
  2⤵
  PID:2100