346d55b4ff926148b5920a8bc6a43081986f2aed5cf350f93b89899fa16f8a68

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
07-01-2025 00:27

Target

NL7Data0404.dll
Size

2.2MB
MD5

81b14fd1c9d2b830e55c93c4c38afa2f
SHA1

975bef050d9e8d2ee577e1b4db5dd6e2d67bff20
SHA256

878e2dbac4b6a6bcce54742f3c7bfd87aa93a6637cccc1e5d18ab65215d81bee
SHA512

16bcd415ca4cfc8813d990a304723a87122eede56a4f2c84b8fac91ccb0d5fd9c2db413358eecf145c1faad5b74f16b516a3c5e12f977bbca0cb6f66cc73d3ec
SSDEEP

24576:WckkkkkkHxKjbNX7UtOGwu1fg5tXVD539swzYNefx+Pff5pn3DXBdVjtxv/Ui:WeKYtOGwu1fg5FtJ9nMX5bL9z

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 620	2644	rundll32.exe	30
PID 2644 wrote to memory of 620	2644	rundll32.exe	30
PID 2644 wrote to memory of 620	2644	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NL7Data0404.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2644 -s 112
  2⤵
  PID:620