3a7ad3d6436b345e4229b659cbff25f75afe949aa9dca89cbc117290b7d11eab

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
23-06-2024 03:10

Target

files/acdbase.dll
Size

2.9MB
MD5

dace23695dcfa0f7309b65366ac75bc0
SHA1

c5b1bad2dec36852fae90f81f0dbd00518479c01
SHA256

cf8b85beeff99b13d06ed15c79e555ab74e30dfa1491a36c4332f54ed09887e4
SHA512

0e1e5fc158fb39c3c3c7733226cb846407cd01ca1c49800fb7668134ebef129ab43030f2768a8b149b5ba9a18b2d1b0f8bf23d1a8de487a482e9268e0b679bbb
SSDEEP

49152:yQzvI/48LzIpH2aTZ70W6pVLOVicH+4T7snimYvtgbgwvWgfFv5COWaUsz7XapvL:yrIpHGpVL7nimatSgSWhOWaUsz7XapvL

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2052 wrote to memory of 1332	2052	rundll32.exe	28
PID 2052 wrote to memory of 1332	2052	rundll32.exe	28
PID 2052 wrote to memory of 1332	2052	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\acdbase.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2052 -s 88
  2⤵
  PID:1332

memory/2052-0-0x0000000001D20000-0x000000000211A000-memory.dmp

Filesize
4.0MB

Download