b03c598a9c3feee2a84444c76df32e7f864a2340e6d675f5bc52000b68279390

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 01:08

Target

b03c598a9c3feee2a84444c76df32e7f864a2340e6d675f5bc52000b68279390.dll
Size

3.2MB
MD5

f640c47fa37bb0b0ab48188b05934a2f
SHA1

442d24b3b1539975ed440bd25a7f2195c096c6ea
SHA256

b03c598a9c3feee2a84444c76df32e7f864a2340e6d675f5bc52000b68279390
SHA512

a43622c80af00a79ce565939f5529ecab2cd6b7f5fb8fc46ce1e425c1734c227fb3638794a1d9af75d9f971be0a3d56e3f8415b649e0fa2d8ee8f76c60c425ca
SSDEEP

49152:T6DRzRmr/M7IG18IdoCMiTG0jfSivJ1reCVJqwYF:iRGGqaMJTivjih

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2268	2316	rundll32.exe	30
PID 2316 wrote to memory of 2268	2316	rundll32.exe	30
PID 2316 wrote to memory of 2268	2316	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b03c598a9c3feee2a84444c76df32e7f864a2340e6d675f5bc52000b68279390.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2316 -s 80
  2⤵
  PID:2268