28327d9e90781c714d6951c767b3fa88396048b81178e9b691ab8edef0e59cf7

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
05-01-2025 12:15

Target

bin/tbb12.dll
Size

374KB
MD5

123404fa3ab377e006e8bb777dc58b36
SHA1

f716b9bc1dd30bd903c377de8ba08d1dee2827c0
SHA256

061f3b283b3e5b24c5ac45772ee19e2f4b24cdacb3ff8ae4f815fe62836e5a45
SHA512

4762511c8f75f0ee88e0b0c030fc4ded3681bd95f57b44d858a5f97bfb918d8f51df7fbed2fd473e3bd491ffec4dc1a290c3894a985cd2d7a959de140659782e
SSDEEP

3072:LMz+pybccWv9lxKs66IYtmm17NakuCzbLModItR4KzdyHohj6bdJ9qDyh6tm4MBS:LMqpyOlxKOmm17NfLPSwKL8ItmhxpLO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2780	2704	rundll32.exe	30
PID 2704 wrote to memory of 2780	2704	rundll32.exe	30
PID 2704 wrote to memory of 2780	2704	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\tbb12.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2704 -s 80
  2⤵
  PID:2780