29081253537f8c90e40915430d712693ceb7cc941718f53395708067e142a041

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-01-2025 00:11

Target

tk86t.dll
Size

1.5MB
MD5

ef0d7469a88afb64944e2b2d91eb3e7f
SHA1

a26fd3de8da3e4aec417cebfa2de78f9ba7cf05b
SHA256

23a195e1e3922215148e1e09a249b4fe017a73b3564af90b0f6fd4d9e5dda4da
SHA512

909f0b73b64bad84b896a973b58735747d87b5133207cb3d9fa9ce0c026ee59255b7660c43bb86b1ddeef9fbb80b2250719fd379cff7afd9dbec6f6a007ed093
SSDEEP

24576:gR3uXVFKflt2zwvzPYHURwgVdF9EWyCzfdmHQnveD4CGan9nViFoHb15K3cmwdbi:SeFSpvzg0RwgVdF9EWyCzfdmHQnveD4r

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2528	2060	rundll32.exe	30
PID 2060 wrote to memory of 2528	2060	rundll32.exe	30
PID 2060 wrote to memory of 2528	2060	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\tk86t.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2060 -s 168
  2⤵
  PID:2528