07c66786984d1e94f9db455a825b1f25c5010a74267ce22820cfaaf0387004cf

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 01:03

Target

07c66786984d1e94f9db455a825b1f25c5010a74267ce22820cfaaf0387004cf.dll
Size

162KB
MD5

b2d79830ad28d55150cdb4e3acd0baf2
SHA1

35269eb027a5f062420cb6bc387fcd89bc092f51
SHA256

07c66786984d1e94f9db455a825b1f25c5010a74267ce22820cfaaf0387004cf
SHA512

a3d4171adc2c4c4fa0626e449a1e432f5b7f84b91868b760852e6614a17d6663f73e24f20de3f772236efec95852646c02de58924aaa921ab93b9bcb946bb583
SSDEEP

3072:pIL1AxMgtig4/GwNu8A+rBGSB+Y+/UtBcGHXfUgxb:6WxMtg4NNu8A+rBGCceXb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 1944	2392	rundll32.exe	30
PID 2392 wrote to memory of 1944	2392	rundll32.exe	30
PID 2392 wrote to memory of 1944	2392	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\07c66786984d1e94f9db455a825b1f25c5010a74267ce22820cfaaf0387004cf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2392 -s 108
  2⤵
  PID:1944