285bd560ee6ee5bf2eea338b2a28f55640ccbbf739426651c3f0dbf04b078b27

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 13:38

Target

SecuriteInfo.com.Win64.MalwareX-gen.9529.25885.dll
Size

436KB
MD5

cac3d6db2ee73dd1f4f8c3a3f0684ea6
SHA1

1c8f41c3a4c9971f0a9524a9f2321353b96167e1
SHA256

285bd560ee6ee5bf2eea338b2a28f55640ccbbf739426651c3f0dbf04b078b27
SHA512

5ae95100826b12d3b034df58c7e3fc8e774ed70459b15aba7da752e072deb541dea738183d261a785df76b46d49be75e08b0ce5723d26e6305a5ddf5096ec87f
SSDEEP

6144:4Br/zRnWyo5X/9aH/9att6tcwTpz0kA2AYSJ0GDkLTtVJfJh4QqUlqoIauZWk3Bg:4BHRnWyoy2sY0OpPkILEd+x

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1648	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2444	1648	rundll32.exe	31
PID 1648 wrote to memory of 2444	1648	rundll32.exe	31
PID 1648 wrote to memory of 2444	1648	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.MalwareX-gen.9529.25885.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1648 -s 140
  2⤵
  PID:2444