0b5c2c6f7dd63838892aaf7fb001c62ef45385fa642b24739d7b21bb0a70d7a0

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16-07-2024 04:50

Target

6e525daab3c0fd277da44ae4a11ca260N.dll
Size

44KB
MD5

6e525daab3c0fd277da44ae4a11ca260
SHA1

a88c68f9922581a02b7eb4fa249f6beecc4445a4
SHA256

0b5c2c6f7dd63838892aaf7fb001c62ef45385fa642b24739d7b21bb0a70d7a0
SHA512

5c108676413597f0e346825b331751833816ce6b3e0f3ff0d7b2dd978f2fd0a48d26ceb52f951b352b8e3a67d0cfab81762d080dca94f737f515884afd83a137
SSDEEP

384:liWe6RE3c6lqst5nZvS05fJjPXR51RWmbzw+XfeDky85xHrwB2BWrYKWodHRN7WG:it3csN7xPXdRdP/ve6HrEUqejzDbzKSw

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1696	1964	rundll32.exe	30
PID 1964 wrote to memory of 1696	1964	rundll32.exe	30
PID 1964 wrote to memory of 1696	1964	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6e525daab3c0fd277da44ae4a11ca260N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1964 -s 80
  2⤵
  PID:1696