47c878c88823bf3f8425fc1e671781c1b977b18f0f1a6d5b8982313c815517dd

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-09-2024 01:07

Target

47c878c88823bf3f8425fc1e671781c1b977b18f0f1a6d5b8982313c815517dd.dll
Size

135KB
MD5

69771857813380d2dd5247697e61e148
SHA1

58149af7f0d5b71f430368245cde540e5d078366
SHA256

47c878c88823bf3f8425fc1e671781c1b977b18f0f1a6d5b8982313c815517dd
SHA512

c88ef6c28a4a118fc01feee04ab0bbef15817ba13391fde6738ec4766c880dbf3bc7c5a1e095f72365b2ee5be7489ad0a5d56f932f5fd53e2aebb7698110052e
SSDEEP

3072:fVu+MVUHGkuFdbungvo5V7yTeAI5sIT5aLPRk:z0UHUrugvOVMITULR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 1268	2224	rundll32.exe	30
PID 2224 wrote to memory of 1268	2224	rundll32.exe	30
PID 2224 wrote to memory of 1268	2224	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\47c878c88823bf3f8425fc1e671781c1b977b18f0f1a6d5b8982313c815517dd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2224 -s 88
  2⤵
  PID:1268