9814a8f9f29e6efb4a7896f61ced334cc5567c3aa61a66325eca76360f1226b4

Resubmissions

28-09-2024 07:53

28-09-2024 07:50

28-09-2024 07:38

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-09-2024 07:50

Target

level.dll
Size

789KB
MD5

4b393812c9241e1c77eef7c09ce1e1d9
SHA1

6139ef7bb6c9b0b48bedd755917e7944483e54c4
SHA256

9814a8f9f29e6efb4a7896f61ced334cc5567c3aa61a66325eca76360f1226b4
SHA512

a55206bf2df1ee322bbede2dd738fb67f2672398cc4289c5a5a63c76105dabf9633c9126d72a65110ff8a1cda7210371ead704d8027c7bd13ebc5078811ea508
SSDEEP

6144:GhQd+ZW/3TvUCWysU2XN92nIMkS9yjygIL1ZaquKIwsjd5vRukMi/mf+0Hlqn//P:sEv9yjpIrH6BjfEkPmt+/bYujcpZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 3012	2712	rundll32.exe	30
PID 2712 wrote to memory of 3012	2712	rundll32.exe	30
PID 2712 wrote to memory of 3012	2712	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\level.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2712 -s 96
  2⤵
  PID:3012