4b51126dd6a63058e3fd7f51435a7b1c1115abf00f3963cb6786314d38dd04e5

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 08:22

Target

4b51126dd6a63058e3fd7f51435a7b1c1115abf00f3963cb6786314d38dd04e5.dll
Size

476KB
MD5

1c3c1aad862989c019b93f7a21eae694
SHA1

4b243aa993730bbe4d2ff4ebcf99752dcdfbe9e9
SHA256

4b51126dd6a63058e3fd7f51435a7b1c1115abf00f3963cb6786314d38dd04e5
SHA512

3284e9a84b73a235bfe8e6da390d3dfba149f9f4d93ce546ed202f36db4509ee4a571439bd4336fc3abdafd87407a4482569e45e10b3b6326313a7cce6f8bc96
SSDEEP

12288:gSYEt5DILgNBuQVe1VKrYog/Qi+Ld87GUA2:gve5DMgLuQYDKrKIBmGX

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1620	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1700	1620	rundll32.exe	28
PID 1620 wrote to memory of 1700	1620	rundll32.exe	28
PID 1620 wrote to memory of 1700	1620	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b51126dd6a63058e3fd7f51435a7b1c1115abf00f3963cb6786314d38dd04e5.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1620 -s 108
  2⤵
  PID:1700