7c694606b4fc1f44ed97a7b79764a0e9f6a78f1406102728525195f8ef810d2a

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/12/2024, 15:17

Target

7c694606b4fc1f44ed97a7b79764a0e9f6a78f1406102728525195f8ef810d2a.dll
Size

18KB
MD5

47612ccda8c909055a4b7451edafb0ec
SHA1

135aae0dc9e0e0603af77c427f2baf9b6118c558
SHA256

7c694606b4fc1f44ed97a7b79764a0e9f6a78f1406102728525195f8ef810d2a
SHA512

4a4a707fa9274cd66acc9cf95bc8fb614ede5f0411c913c3decd6b43e28be74ce942b2bd6232b612109d07e6abd704ec8e905755be4feea535e4760b8aa40fbd
SSDEEP

384:5qlY3fl9s7ipnqokLlpTf9ooFeBV8nPas5s6/GheQVrA:IGtoQqF2ogzyPas5sbV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 3068	2092	rundll32.exe	30
PID 2092 wrote to memory of 3068	2092	rundll32.exe	30
PID 2092 wrote to memory of 3068	2092	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c694606b4fc1f44ed97a7b79764a0e9f6a78f1406102728525195f8ef810d2a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2092 -s 80
  2⤵
  PID:3068