930a512acd2431ef53142ac78a0febd2b5a911abe5d938197691bafb0776d388

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 14:40

Target

930a512acd2431ef53142ac78a0febd2b5a911abe5d938197691bafb0776d388.dll
Size

313KB
MD5

64c27123a3eca4f8bd2e6c3f08689e3b
SHA1

362945d717e05c0d269511b9dc1c069ef6f06cc4
SHA256

930a512acd2431ef53142ac78a0febd2b5a911abe5d938197691bafb0776d388
SHA512

45daaa91929e01d2c5d7953cc9375a2944a4dced189083b4676ba89b16ea424a624e0461b64c4a495d0911e73cd11f86551799c7b91f46de363120a730407cdd
SSDEEP

6144:hsy8LdLa9uXqnrztPS8simrHo7NVS7P5S6RnHbohT/JEFyCN:hsy8LdLaKqnlPLB+ojc5S6R7oDEIM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2164	2084	rundll32.exe	31
PID 2084 wrote to memory of 2164	2084	rundll32.exe	31
PID 2084 wrote to memory of 2164	2084	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\930a512acd2431ef53142ac78a0febd2b5a911abe5d938197691bafb0776d388.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2084 -s 80
  2⤵
  PID:2164