0e76583f0e75bcc9f61bbc3163e694042e9afa5c9ab71cadc6df85f27450360e

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 18:19

Target

0912658781c822ae5cdf5099162c6520N.dll
Size

436KB
MD5

0912658781c822ae5cdf5099162c6520
SHA1

e84dc09ca126b4f0cc7424e28dcd6e9edf13ea4e
SHA256

0e76583f0e75bcc9f61bbc3163e694042e9afa5c9ab71cadc6df85f27450360e
SHA512

dc8f2daec2798bc8ce82135eb2b426ac61d37c5d60cbafebb299bd155069f0674f8f4a93ff48025305988f99690d1a65b4e5b5d7905d21a80f42b0b61fd870b2
SSDEEP

6144:IBr/zRnWyo5X/9aH/9att6tcwTpz0kA2AYSJ0GDkLTtVJfJh4QqUlqoIauZWk3Bg:IBHRnWyoy2sY0OpPkILEd+x

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2080	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1864	2080	rundll32.exe	30
PID 2080 wrote to memory of 1864	2080	rundll32.exe	30
PID 2080 wrote to memory of 1864	2080	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0912658781c822ae5cdf5099162c6520N.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2080 -s 144
  2⤵
  PID:1864