9f5225e96beefaf5c8294fba8942451f2e1b984c041eb749e19d4c01a921d8b5

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-02-2025 18:40

Target

9f5225e96beefaf5c8294fba8942451f2e1b984c041eb749e19d4c01a921d8b5.dll
Size

2.1MB
MD5

a62cbfa41b6580df22af82455c757793
SHA1

2496ec79477c1ada4bd014691ab16369a24132c0
SHA256

9f5225e96beefaf5c8294fba8942451f2e1b984c041eb749e19d4c01a921d8b5
SHA512

939af5a5c36c361abf07922513245a8f354ffcc145d0703aa226665b1352ce42504aade723d29c1a61cc984855ae9e9188f14590b29fabcf7aa2bc17e483f155
SSDEEP

49152:bGgJ3vE7rwsY5+a+h1cHkUnl/u9Zx/PgxeAaEn/8m6prG:NavI5+qHxsgxeAHsrG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 2124	1416	rundll32.exe	31
PID 1416 wrote to memory of 2124	1416	rundll32.exe	31
PID 1416 wrote to memory of 2124	1416	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f5225e96beefaf5c8294fba8942451f2e1b984c041eb749e19d4c01a921d8b5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1416 -s 52
  2⤵
  PID:2124