5c42ee9854d6566d3138fe23cb9c973e74444baecb10fcfd80e772e6dc1c47f0

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 11:07

Target

x64/SSCbFsNetRdr3.dll
Size

108KB
MD5

8b694d7742f69e2954f8efe5b2761c48
SHA1

b9d614b762f8d6c887d433d891221133bd32e899
SHA256

8ff4097a469e52dcadf39115e8a6caa7cd0f0ba215171378821f660ffdc8d910
SHA512

c1a8c58d2a0f033c71672e62d8195a5337e79103c87018fb513de2e24e4cf815d069f5232916f693b2b13bd039675e4a77b8f6b9acdb215c93b6d928b842eaeb
SSDEEP

3072:8BbUqska7adxarvTNjG/dkHTGtPpTel8QEzLYwyindh7wFQR8c:8BgLkaadxarvTNjFTGtPdelVAhGlc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2388	2420	rundll32.exe	30
PID 2420 wrote to memory of 2388	2420	rundll32.exe	30
PID 2420 wrote to memory of 2388	2420	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x64\SSCbFsNetRdr3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2420 -s 144
  2⤵
  PID:2388