a6495e8c47a4dc4e328e9271e0dec628d2a4f85e4a3be166ae156b44666f0c30

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 00:29

Target

a6495e8c47a4dc4e328e9271e0dec628d2a4f85e4a3be166ae156b44666f0c30.dll
Size

36KB
MD5

fa1c4bc608f599fa790746064ed0eacf
SHA1

b9eb44aedf15a7640e52faac9275fbe27cd704d1
SHA256

a6495e8c47a4dc4e328e9271e0dec628d2a4f85e4a3be166ae156b44666f0c30
SHA512

097e5ef86fa0ba4713d80f3766da0ecfde21296bbb59e483ddf022e1231da23aa2a21a1d5ad957ee1499da831ef9ac2da5cd8b425ea703d11abd3f025612c51a
SSDEEP

192:hHVMfa7TTCjJSixzPSAA56RCK7Yu/VPgwdhuXBAQYfPq/3KbW:h1Mf0gJSix2AA56RCiZV2GQYnq/6bW

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2224	2296	rundll32.exe	30
PID 2296 wrote to memory of 2224	2296	rundll32.exe	30
PID 2296 wrote to memory of 2224	2296	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6495e8c47a4dc4e328e9271e0dec628d2a4f85e4a3be166ae156b44666f0c30.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2296 -s 52
  2⤵
  PID:2224