9ccb0bc19f24b694a4129cc387279457e57671f8109937550258ffc40173423b

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
04-08-2024 17:36

Target

sdkencryptedappticket64.dll
Size

1010KB
MD5

89491f37434a1848e016fa89bdc436e9
SHA1

4964f032ae077f8a2ba2848c57d95e1ceefdeeb4
SHA256

151b53f46c0d163ac2b47531508df942a92295fe75cbaa99e481339cb4ae82f3
SHA512

ba4004255edeb80eb385aafeee9a2b5da0968c026c7b002fc87539a449c60ecbbd78c2ea112f43b1c82e28863e22d2b8989814145c6924c666b2c82a4825893c
SSDEEP

24576:2BPcoPGk/xmJagU6ZivRa684r6dubOU9/Vxi7Cm9jw1o:OPcIGk/xmJagU6ZivRa684rzbOU92CmP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2092 wrote to memory of 2708	2092	rundll32.exe	WerFault.exe
PID 2092 wrote to memory of 2708	2092	rundll32.exe	WerFault.exe
PID 2092 wrote to memory of 2708	2092	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sdkencryptedappticket64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2092 -s 80
  2⤵
  PID:2708