b28f7e6c4ffb60523318927e1fc72f8900f30b24f7a92eeeba0b6721cd2cbd19

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 14:01

Target

b28f7e6c4ffb60523318927e1fc72f8900f30b24f7a92eeeba0b6721cd2cbd19N.dll
Size

861KB
MD5

efe12d616420d33465e56985f5fef7e0
SHA1

d6338b3166ee33d92085ad165525ab04ed38b7a9
SHA256

b28f7e6c4ffb60523318927e1fc72f8900f30b24f7a92eeeba0b6721cd2cbd19
SHA512

ec5f65764d9bc1f94146335bcd9811f7c3700b577e6050a385bfc4f9643de752d48176e4e9f0c1a964b742c6da31d6350f16d27dfba8fec02caea91c78aedd06
SSDEEP

12288:zy32+ji2phoj0/7zHZ7G5hs6NjkEoFuek5+na7lD7o6:nX2/oj0VGjbjkEnto6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 1632	2524	rundll32.exe	30
PID 2524 wrote to memory of 1632	2524	rundll32.exe	30
PID 2524 wrote to memory of 1632	2524	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b28f7e6c4ffb60523318927e1fc72f8900f30b24f7a92eeeba0b6721cd2cbd19N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2524 -s 100
  2⤵
  PID:1632