ff90afcee30f47a6ba5195543d474248e588db8da906edc73868f4c34353ff5c

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 09:02

Target

ff90afcee30f47a6ba5195543d474248e588db8da906edc73868f4c34353ff5c.dll
Size

183KB
MD5

1f917577cdcaca357c041be83be90d9e
SHA1

acd0146587c2734f7c42610b0f6c6760821f8c03
SHA256

ff90afcee30f47a6ba5195543d474248e588db8da906edc73868f4c34353ff5c
SHA512

fa9ad07306f83586b624882dbcb6e4639192ccab8ee19fff382f0b51e86d6d72d5639992b7f5f6241dc4e10387e67aa8556c7db03c312f46c32dca659a7b0062
SSDEEP

3072:/hS/N/gh+qjxoeHu0M5CVQIYH5i+DE2CBC6TMQx9cfS5OnRa3lW0l+o:/hS/N/gh+qt9Hu0FQIYH5i+A2CBC0Niw

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 1796	2096	rundll32.exe	30
PID 2096 wrote to memory of 1796	2096	rundll32.exe	30
PID 2096 wrote to memory of 1796	2096	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff90afcee30f47a6ba5195543d474248e588db8da906edc73868f4c34353ff5c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2096 -s 80
  2⤵
  PID:1796