38dfabc15d453255a2496e295d6171f573342e9e6c4ad2c98af99b3058a4eef8

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 15:17

Target

38dfabc15d453255a2496e295d6171f573342e9e6c4ad2c98af99b3058a4eef8.dll
Size

54KB
MD5

c900d236f7fcc2804c746661b0182429
SHA1

e8a076dea1d171ee32133bce0056253906bec1c7
SHA256

38dfabc15d453255a2496e295d6171f573342e9e6c4ad2c98af99b3058a4eef8
SHA512

7de21c800b246ee1c67a4cd2301211f3a81c736ffaf186ecaf69f608b3c1d7650487c8348dc5bb1af8a81d18440de3235d3ed122163e934a0bf1421589dd39e7
SSDEEP

768:YbvfvuFPVpo9YUINaUEy7yJPBUFFXAFrl:Skpo3Ipv7qGPQ3

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 2392	1180	rundll32.exe	30
PID 1180 wrote to memory of 2392	1180	rundll32.exe	30
PID 1180 wrote to memory of 2392	1180	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38dfabc15d453255a2496e295d6171f573342e9e6c4ad2c98af99b3058a4eef8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1180 -s 80
  2⤵
  PID:2392