dc25666f2477f6c7f995e25afb6fa6ff5b56aa147f67b1a48abb6649345fd5c5

Analysis

max time kernel
141s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 16:35

Target

dc25666f2477f6c7f995e25afb6fa6ff5b56aa147f67b1a48abb6649345fd5c5.dll
Size

255KB
MD5

d6155da971b38a40e3a983561c206db7
SHA1

105adabcbfdc5aee2c44cdb79d3bc3510d63bd7f
SHA256

dc25666f2477f6c7f995e25afb6fa6ff5b56aa147f67b1a48abb6649345fd5c5
SHA512

c061d3cbac366e7d8d716eceea3902c6260877d95a8c8f00774c0d066300750438aee164b1fa8d4fd4539b6ff43be2be0cc04f8737db41e7d80a2c78dcdc76aa
SSDEEP

3072:vhsTQwAhK2T5S49FtZH17fqWImmnEtPzXfDw0wfwH2BlPAuaY/IjdNC:vhsTqqIjdNC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2164	2384	rundll32.exe	31
PID 2384 wrote to memory of 2164	2384	rundll32.exe	31
PID 2384 wrote to memory of 2164	2384	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dc25666f2477f6c7f995e25afb6fa6ff5b56aa147f67b1a48abb6649345fd5c5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2384 -s 168
  2⤵
  PID:2164

memory/2384-0-0x000007FEF73F0000-0x000007FEF7423000-memory.dmp

Filesize
204KB

Download