981c2d9a460b0e05ea8631ff90bce96cea2cddd9878162d8967a5df407a52250

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/06/2024, 00:06

Target

981c2d9a460b0e05ea8631ff90bce96cea2cddd9878162d8967a5df407a52250.dll
Size

1.7MB
MD5

2298c6d626b909880db8d71349805008
SHA1

d22cdc2483966d1cc7400dbbf803aa0548ac363a
SHA256

981c2d9a460b0e05ea8631ff90bce96cea2cddd9878162d8967a5df407a52250
SHA512

431604f9b3154ddbd589e79ee1a1183f6081b34fc229e888391a4b23e99d6c032d057cbd50362fadc7b6ffe4b454be743c559586590bfc3374a3c220a7e123e5
SSDEEP

49152:OUPZvHb6YNaolGl+W8xhcLfoSME7tWw1+x1jGFg5:ZPMYNatl+Wvn1i1yFg5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 1804	2420	rundll32.exe	28
PID 2420 wrote to memory of 1804	2420	rundll32.exe	28
PID 2420 wrote to memory of 1804	2420	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\981c2d9a460b0e05ea8631ff90bce96cea2cddd9878162d8967a5df407a52250.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2420 -s 84
  2⤵
  PID:1804

memory/2420-0-0x000007FEF5E50000-0x000007FEF6047000-memory.dmp

Filesize
2.0MB

Download