f87237859e6849d770c327ae300cdfbff8b8f9193e8ace2f739f8629a087b7f3

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-12-2024 23:10

Target

101.34.205.247:8080/cs/help.dll
Size

1.2MB
MD5

21de83ad8b0720eff0d3b3cc99e00ed2
SHA1

b563818772796e6e7dcd768213a733f376c66ada
SHA256

6c2dadc15579a966f4d9116287688ea20fb30f836ed83470a97d81d17eee2fb4
SHA512

71ea9b1b01ab2bb5fb04b7531a36f8f06f9ee1980e364bde2496c5849ae14108033b1225c0a3154679b6f7b73baeb9f4174878cf93edc4273073bc8de11330b4
SSDEEP

24576:0WKYuZA8jIdxk9R57CPi6HxQ+nGBa7Z3bM0KJ3VReBJmTao2s+P3atqTmjrmC9Vy:vuZA8jIdxAR57CPi6HxlnGBa79Y0KJ3E

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 3028	2908	rundll32.exe	28
PID 2908 wrote to memory of 3028	2908	rundll32.exe	28
PID 2908 wrote to memory of 3028	2908	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\101.34.205.247_8080\cs\help.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2908 -s 88
  2⤵
  PID:3028