0095d79268b4f6829a7350d9382623fe91ffc6e8016ea3ff20e173fa4e837034

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 21:11

Target

0b8cfc380514ad17d33b7cac7f403330N.dll
Size

126KB
MD5

0b8cfc380514ad17d33b7cac7f403330
SHA1

f55b70c3dc8155a6e25b07afa3949d64ea866096
SHA256

0095d79268b4f6829a7350d9382623fe91ffc6e8016ea3ff20e173fa4e837034
SHA512

f19da802880424fa9eccb940d68a76eaa393b577fdaa64c446a669a39265c7fdf23fd7e2ddfab07373949f18008eec0c4483cd2e79f9936943fc3bea7c5a176e
SSDEEP

3072:Ag3lbtKL10hkUe94/wj2U0gXkM5istMEBu9bDDmF9hayrxUm:AgVJY0hkUe9ewKUhX5ZWD0ay

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2648	3032	rundll32.exe	31
PID 3032 wrote to memory of 2648	3032	rundll32.exe	31
PID 3032 wrote to memory of 2648	3032	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b8cfc380514ad17d33b7cac7f403330N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3032 -s 92
  2⤵
  PID:2648