16f64ad99b270db27f9169609ca4831e6d353bb815440bd0b74d7340a0d966e0

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 08:45

Target

16f64ad99b270db27f9169609ca4831e6d353bb815440bd0b74d7340a0d966e0N.dll
Size

51KB
MD5

709e8989386cd6bfbe37cca3d6c47890
SHA1

f36db9bb5ca6a8fde4766de26c764cb5b044e6cf
SHA256

16f64ad99b270db27f9169609ca4831e6d353bb815440bd0b74d7340a0d966e0
SHA512

f848f5278e83bb8e0179897b694e6d8a0d159950436bbecdea70e416b32bb9b97b9ba01f0f333b313e3fad50ece5f9385cfb124b256a12afb45db843394c0e26
SSDEEP

1536:oZFokicKgE101aQpZCoITjN2KpgbGxO4I:v28QyjtpgD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 684	3060	rundll32.exe	29
PID 3060 wrote to memory of 684	3060	rundll32.exe	29
PID 3060 wrote to memory of 684	3060	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\16f64ad99b270db27f9169609ca4831e6d353bb815440bd0b74d7340a0d966e0N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3060 -s 96
  2⤵
  PID:684