7a464be070d49cf0d53953907785917666e5ca38513a1a7a81b56edcdb7f15c8

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02/07/2024, 17:10

Target
tbb.dll
Size 388KB
Sample240702-vpnrfasfpf
SHA256 4b5d6f706b1c60fc3074360f9c3503e3b161d043aa5329006e4e26559675f719
MD5 4474b27001b11f30c0a1419c1cda74d2
SHA1 e5534d4e7fa3617ca2484309cf53ab0d22deb539
SHA512 5cedf06cff2a215c7246d56ff29ba0d6c35b318a397018d245f2164e97bab57cbd77275663a260457deca28b5f7221f7a49431fe6c11a8806a270435d21b2a82
SSDEEP 6144:WFjKXrjQhdGgW4dIf/eO1Pz38MYtc7qVfFwzEfT9RlZ:4H7RCPzsZrTbf
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 1732	2420	rundll32.exe	28
PID 2420 wrote to memory of 1732	2420	rundll32.exe	28
PID 2420 wrote to memory of 1732	2420	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\tbb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2420 -s 80
  2⤵
  PID:1732