6d54b652ad0cb553b9a4ddcdfd64f3c38c094a90f7991af3be46c7279a3b0fe9

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 22:24

Target

6d54b652ad0cb553b9a4ddcdfd64f3c38c094a90f7991af3be46c7279a3b0fe9.dll
Size

546KB
MD5

0438be923a4d164d2f65ad0f64656526
SHA1

fc9a25c248cc46fb1fad72d8d99dc09086635e31
SHA256

6d54b652ad0cb553b9a4ddcdfd64f3c38c094a90f7991af3be46c7279a3b0fe9
SHA512

9ab15e45322aaa32cf74fc82127b7371f94537d5933f37ef2c246d6e55a2f74e4424ce7b0bbacffc3c1df8fce1b7e0382c17cc2bc2f5a4f729093ac6b4ed800c
SSDEEP

6144:pmagiPsw2Z0wJ8axnsn5gqJtGc2FAPsByy1zyX2IST20SPrpYE5X:gJpYoFAPsByypqSFE5X

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2172	1672	rundll32.exe	28
PID 1672 wrote to memory of 2172	1672	rundll32.exe	28
PID 1672 wrote to memory of 2172	1672	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d54b652ad0cb553b9a4ddcdfd64f3c38c094a90f7991af3be46c7279a3b0fe9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1672 -s 84
  2⤵
  PID:2172