bad948017a4001a3e9a82fd53bfddb4fd9ddeba4a03eae6aa71a48f3eb69eaad

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-02-2025 03:38

Target

tier0_s64.dll
Size

410KB
MD5

328655e0f2611479a90db044ab130373
SHA1

d678fd28927f05bde277bc3dc5fc51e2b4dce8b8
SHA256

586a9c2a27e906a54182166ec63a02bb6a28eb4e2e7e53a799db928b76fd036d
SHA512

8849dbfa9406c94b9750a6771ba391be95d8b41c53f19f446be92f4f22633975aa7d11b999e9f25b93bc682173ad6e4993486a2ec51c7475046db8daf9b1ebc2
SSDEEP

6144:3gOdWrN3L9iopicrVgNSpmbY+fNo809MmbtkrFCwXNmGzZ4gs7T3D3WG8dvB4h:3gOG3LEopVqYG2809DKriGzZ4g2rWwh

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2528	2972	rundll32.exe	30
PID 2972 wrote to memory of 2528	2972	rundll32.exe	30
PID 2972 wrote to memory of 2528	2972	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\tier0_s64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2972 -s 116
  2⤵
  PID:2528