327430fbfe02ee108bb5c18ad1c740d5e61d7a82835ec5ffdab5ba2d3942aae2

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 15:33

Target

327430fbfe02ee108bb5c18ad1c740d5e61d7a82835ec5ffdab5ba2d3942aae2.dll
Size

633KB
MD5

6301bde6d9f3d525a2edeb6e1ae46ae1
SHA1

28730a07eacfcad3061dad7c3f295fa37f6b49e1
SHA256

327430fbfe02ee108bb5c18ad1c740d5e61d7a82835ec5ffdab5ba2d3942aae2
SHA512

c6fd11b463d5ce7504f24fc9c05a50f179770cb4a9a41a7504e3f882df203213537156b3cc29fa7af3aaeb539b28108bb8afcc1bea1fa2172b3873f09fc8714d
SSDEEP

6144:9YRU2TKHIbISzzTFwTR6bM9zJSteIbKQXDoOL9n8inwsKGxFCxo0H8:9Y22TKczhIolXDoKnnwG0H8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 1628	2756	rundll32.exe	28
PID 2756 wrote to memory of 1628	2756	rundll32.exe	28
PID 2756 wrote to memory of 1628	2756	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\327430fbfe02ee108bb5c18ad1c740d5e61d7a82835ec5ffdab5ba2d3942aae2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2756 -s 104
  2⤵
  PID:1628

memory/2756-0-0x0000000068B00000-0x0000000068B98000-memory.dmp

Filesize
608KB

Download