cb5fdc692321856edbe53ff55b7be978e5f64f7c50997e188be9856494402f08

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/12/2024, 05:46

Target

dbf8dbd2a9d41f7f58e02ed7829fc6538cc03403f547b1a6ad8db6428eb0a934.dll
Size

1.2MB
MD5

65a6a3a9d3b6628a0003ee4b7183e9d7
SHA1

2945bdecbf5980309bcba9eb8877ff602f555ea9
SHA256

dbf8dbd2a9d41f7f58e02ed7829fc6538cc03403f547b1a6ad8db6428eb0a934
SHA512

67f1641d024d1acc1928d20509abccc8c9060635fc2acbdb3b8803d05dc25c93135b37c97681ae303edd23a44c08cf0f403b809b68cc7b632df90c19876e32ed
SSDEEP

24576:8Gs6+jsFgmGYeMwrL75seDh9a2IV4Lc7ytm5FZX6zE5HP:81bvYeDrBskL/mDww5HP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2736	2688	rundll32.exe	30
PID 2688 wrote to memory of 2736	2688	rundll32.exe	30
PID 2688 wrote to memory of 2736	2688	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbf8dbd2a9d41f7f58e02ed7829fc6538cc03403f547b1a6ad8db6428eb0a934.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2688 -s 176
  2⤵
  PID:2736