f7df2385d8f3ce56e5590576c81d47fbacb11fdc78fd7927a19f66c9d4bf7da9

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
27/11/2024, 04:53

Target

f7df2385d8f3ce56e5590576c81d47fbacb11fdc78fd7927a19f66c9d4bf7da9.dll
Size

304KB
MD5

d848d48c1dee77bca37bcf42163c8e2f
SHA1

ce293ee96c8ae136848789fc6def72ddb6846b1e
SHA256

f7df2385d8f3ce56e5590576c81d47fbacb11fdc78fd7927a19f66c9d4bf7da9
SHA512

428b70b64cc193a0e7e3f9d08d59d36c349b17e65348706f8ea084bade9409ee496b96d5a060952209299e9d867194441d06cb79d194941b4edb33d8cfc01d5f
SSDEEP

3072:TJwpS2NACV4qAbypuljJGnJYoTjqETdtbsnOfFwXVa/eSbVjYJBaXM6ENeHnaHr:TJwpYVNcn3pTdNe+WXViBjBNH6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2460	2916	rundll32.exe	29
PID 2916 wrote to memory of 2460	2916	rundll32.exe	29
PID 2916 wrote to memory of 2460	2916	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7df2385d8f3ce56e5590576c81d47fbacb11fdc78fd7927a19f66c9d4bf7da9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2916 -s 56
  2⤵
  PID:2460