94ea34e3b65d8b428ead7edeb3a92a2f28086d0df93bdf008e3bb8dee1f7e94c

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 14:36

Target

V17 Sorunsuz Çalışan/fontfix.dll
Size

10KB
MD5

0fa5efd92129358430f351a5d6f33762
SHA1

d889650bc4512470731d26b0a0c65f2118086f23
SHA256

407e583165217d18f3cc4179ad754c8e7f38b27057316a382151dd32f258cc82
SHA512

bf651aa682d402338b123769a0b1594ab84df5bbaa2157ccc4ae1fb434de0293179191abd5c6b1df2faa5bee59142c3f0e18b0a46d686374da01bf84c08e87ed
SSDEEP

96:inUFVvgAc5BxvDBbyPA1dAGbec0JWU+u9skIPp6EJBaA3ye45Lpx1N+T:inggdBVDNyPAvF5tuKp6EfajLpx1k

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 1052	2368	rundll32.exe	31
PID 2368 wrote to memory of 1052	2368	rundll32.exe	31
PID 2368 wrote to memory of 1052	2368	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\V17 Sorunsuz Çalışan\fontfix.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2368 -s 184
  2⤵
  PID:1052