ef8db4febcf21fed5380a0b05735c612165b93e1f6d4476be0f4052b17d10155

Analysis

max time kernel
18s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 06:51

Target

ef8db4febcf21fed5380a0b05735c612165b93e1f6d4476be0f4052b17d10155N.dll
Size

100KB
MD5

90d6d35a333f37870d90cf857eefacb0
SHA1

249d49d463bf8cab4e5f23672d447c55ae71f005
SHA256

ef8db4febcf21fed5380a0b05735c612165b93e1f6d4476be0f4052b17d10155
SHA512

0fa1c9e679cae437160de64c1d57e52704f8390b0747722242c521eb439824927928b97c40e854e5d6cecfc6b4e8e6aa9294ba92d411e02ff435a4943cd13c26
SSDEEP

3072:OcV5lEwUbShbpbaCpv8YSZOYxIr9oI6Hai:OcVDzGeblaCpEYSZO6IrV6Hb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2904	2292	rundll32.exe	28
PID 2292 wrote to memory of 2904	2292	rundll32.exe	28
PID 2292 wrote to memory of 2904	2292	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef8db4febcf21fed5380a0b05735c612165b93e1f6d4476be0f4052b17d10155N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2292 -s 80
  2⤵
  PID:2904