b5d1b9d705b38dae319e6ab900f26d5c3ace3b1810c34e79da5a459c6a84dc05

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 13:58

Target

b5d1b9d705b38dae319e6ab900f26d5c3ace3b1810c34e79da5a459c6a84dc05.dll
Size

101KB
MD5

69d86f6b505b15ae25637430de451ad0
SHA1

3def055178926ed0457e19abf2c21529dce141f1
SHA256

b5d1b9d705b38dae319e6ab900f26d5c3ace3b1810c34e79da5a459c6a84dc05
SHA512

adeed1eca5a1704c98645a36a1ffdc3c5e7775394453b11f19485b00de32c6c2bdb411de4faf31492571ea40f1028929ecfb95c9159bfd79bf20d367a4eec7fa
SSDEEP

768:Ij4nkOeFZfUPcq8lelE+yevj8KqKBN9QYM6mfnetT:uOeDfXqHlEJXuN9QYM6mfnYT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 1980	2444	rundll32.exe	30
PID 2444 wrote to memory of 1980	2444	rundll32.exe	30
PID 2444 wrote to memory of 1980	2444	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b5d1b9d705b38dae319e6ab900f26d5c3ace3b1810c34e79da5a459c6a84dc05.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2444 -s 92
  2⤵
  PID:1980

memory/2444-0-0x000007FEFBA90000-0x000007FEFBAA0000-memory.dmp

Filesize
64KB

Download