864401dbbe33105ad66198406ae09206b1019dd9b4c2987a4c41d0771c4aca6c

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 13:05

Target

864401dbbe33105ad66198406ae09206b1019dd9b4c2987a4c41d0771c4aca6c.dll
Size

7.5MB
MD5

50f91344c30ee997d7dc5b31937e3dbe
SHA1

bc0cd10f74aeb0d6223b691415ddd66a322fde25
SHA256

864401dbbe33105ad66198406ae09206b1019dd9b4c2987a4c41d0771c4aca6c
SHA512

e525d2ca919039bebc54b0e59fbbc54be8382ceaec5732c77cd389495116824af5bda8e394ee391412f5a86a76b35738e2b421bbf168e12e073532449e71d056
SSDEEP

12288:hlhCDFchFchFchFchFcJerzggNFiq33VderzggNFiq33VderzggNFiq33VELyLyM:hlhCF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2500	2092	rundll32.exe	30
PID 2092 wrote to memory of 2500	2092	rundll32.exe	30
PID 2092 wrote to memory of 2500	2092	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\864401dbbe33105ad66198406ae09206b1019dd9b4c2987a4c41d0771c4aca6c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2092 -s 80
  2⤵
  PID:2500