e1783c551610bce488e95409b7b30020abb19a1f0fdf305883da9de983b6b8dd

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
07-01-2025 00:20

Target

NL7Data0404.dll
Size

2.2MB
MD5

81b14fd1c9d2b830e55c93c4c38afa2f
SHA1

975bef050d9e8d2ee577e1b4db5dd6e2d67bff20
SHA256

878e2dbac4b6a6bcce54742f3c7bfd87aa93a6637cccc1e5d18ab65215d81bee
SHA512

16bcd415ca4cfc8813d990a304723a87122eede56a4f2c84b8fac91ccb0d5fd9c2db413358eecf145c1faad5b74f16b516a3c5e12f977bbca0cb6f66cc73d3ec
SSDEEP

24576:WckkkkkkHxKjbNX7UtOGwu1fg5tXVD539swzYNefx+Pff5pn3DXBdVjtxv/Ui:WeKYtOGwu1fg5FtJ9nMX5bL9z

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2384	2136	rundll32.exe	31
PID 2136 wrote to memory of 2384	2136	rundll32.exe	31
PID 2136 wrote to memory of 2384	2136	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NL7Data0404.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2136 -s 112
  2⤵
  PID:2384