8e6e83ba1eb2ceb0eddc7e0fd98e1fb775f4809e4acfe8d5e66dadaa806ad2d5

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-12-2024 01:29

Target

Lanthanotus95/Inlayed/Hovedvagts/completion.dll
Size

102KB
MD5

4a477c399809389ee929075a8f5c3df5
SHA1

ae74641e248efad5a294d9e5176a34676240cff7
SHA256

4a2618e2e03ab9e6e1563d95641b582beec5b1d87e6ba7acfb9cb1d12256706b
SHA512

0e917469ac397a4b1490a312418a8e9338c4a47b7b23e0bc7681860ae923af1ea0a370322efcf94203adbb5e595325d1ab97cf42ccf9522ba6db48d10f37c9f9
SSDEEP

768:v9s4rJ2zatJn27vnvFqNFgkq9h2zTfJSfVnl22MQZ5qi5K1U7cqHTgp37CtSxu3v:vNrJ2oJi/GFgz9hehS9nktQqtc2VE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 840	2100	rundll32.exe	30
PID 2100 wrote to memory of 840	2100	rundll32.exe	30
PID 2100 wrote to memory of 840	2100	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Lanthanotus95\Inlayed\Hovedvagts\completion.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2100 -s 80
  2⤵
  PID:840

memory/2100-0-0x000007FEF84C0000-0x000007FEF84E1000-memory.dmp

Filesize
132KB

Download