6b1291a1c07ac8156662015b2d8cccadde0feed334bc590e13a4b4c1bd06d66d

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 22:59

Target

6b1291a1c07ac8156662015b2d8cccadde0feed334bc590e13a4b4c1bd06d66d.dll
Size

202KB
MD5

f6e5b0fc897c9440943cdac6b9f047f6
SHA1

d5621f9bbe3f8a62fc8407b698ce79e86fd703ee
SHA256

6b1291a1c07ac8156662015b2d8cccadde0feed334bc590e13a4b4c1bd06d66d
SHA512

d168d64883eede54971fdcdbab200101d7f7c59a5fb778a7f01372961828cc665b26cc84ce8d3c320c0b1ccc3fd76a8c04ed2171eeb829f05cc89e40af4d21b2
SSDEEP

3072:56JGVOPz1Q+KK6AMMLBok9YLn+DDXXtURanAqQstHKc5IcFidXOwOvFO++:kJGMb1Q+HlLBokJDD+GDQkNIcFjwe8r

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 1456	1952	rundll32.exe	28
PID 1952 wrote to memory of 1456	1952	rundll32.exe	28
PID 1952 wrote to memory of 1456	1952	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b1291a1c07ac8156662015b2d8cccadde0feed334bc590e13a4b4c1bd06d66d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1952 -s 108
  2⤵
  PID:1456