558b4a4676c5f805f5db02672aedc7d89f26bad579230037490a1a7dc5093bf2

Analysis

max time kernel
93s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 13:48

Target

558b4a4676c5f805f5db02672aedc7d89f26bad579230037490a1a7dc5093bf2N.dll
Size

36KB
MD5

a87e3ef2a33a4efc07604a883191faa0
SHA1

52ca199346f7d1e0f534a7ffb97e870b65363c84
SHA256

558b4a4676c5f805f5db02672aedc7d89f26bad579230037490a1a7dc5093bf2
SHA512

01a3341a3db14790005773a367f4900fa1ea2c5f4c67a9d53d8777cd67c067670042e19e53ba2753f723121ba054283865488da6e8486a51cff2266cb0ed0da7
SSDEEP

192:hHVMfa7TTCjJSixzPSAA56RCK7Yu/VPgwdhuXBAQYfPq/3Kb:h1Mf0gJSix2AA56RCiZV2GQYnq/6b

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 844	2552	rundll32.exe	30
PID 2552 wrote to memory of 844	2552	rundll32.exe	30
PID 2552 wrote to memory of 844	2552	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\558b4a4676c5f805f5db02672aedc7d89f26bad579230037490a1a7dc5093bf2N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2552 -s 56
  2⤵
  PID:844