756607ef660b6a73560e19ab180ed3a031ab44637095c2675bbb412e31fdb9a1

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 14:29

Target

756607ef660b6a73560e19ab180ed3a031ab44637095c2675bbb412e31fdb9a1.dll
Size

12KB
MD5

7356ad6fc8600dd5bff1df642419ebed
SHA1

7036265ef2621339545016ba054b34207efb403b
SHA256

756607ef660b6a73560e19ab180ed3a031ab44637095c2675bbb412e31fdb9a1
SHA512

cca0cb4bc4f84460174c99922b947c5338fec31bd340ce538d9d46b66c46bf9f3a502788588ba862746c932ec13e116108312f209e73f8eeff39b57e684bc95b
SSDEEP

192:rjBMLQF/0lSpEyvsq7yCqfHbyENkcqDcW:rNMLM39J78YDcW

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2352	1640	rundll32.exe	30
PID 1640 wrote to memory of 2352	1640	rundll32.exe	30
PID 1640 wrote to memory of 2352	1640	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\756607ef660b6a73560e19ab180ed3a031ab44637095c2675bbb412e31fdb9a1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1640 -s 80
  2⤵
  PID:2352