a18fb19c7e1e805155fdd956e00046c6e492fce5b07aa1e21b688758ff8dbb22

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
09-02-2025 21:35

Target

bootstrap/tier0_s64.dll
Size

410KB
MD5

328655e0f2611479a90db044ab130373
SHA1

d678fd28927f05bde277bc3dc5fc51e2b4dce8b8
SHA256

586a9c2a27e906a54182166ec63a02bb6a28eb4e2e7e53a799db928b76fd036d
SHA512

8849dbfa9406c94b9750a6771ba391be95d8b41c53f19f446be92f4f22633975aa7d11b999e9f25b93bc682173ad6e4993486a2ec51c7475046db8daf9b1ebc2
SSDEEP

6144:3gOdWrN3L9iopicrVgNSpmbY+fNo809MmbtkrFCwXNmGzZ4gs7T3D3WG8dvB4h:3gOG3LEopVqYG2809DKriGzZ4g2rWwh

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2840	2776	rundll32.exe	30
PID 2776 wrote to memory of 2840	2776	rundll32.exe	30
PID 2776 wrote to memory of 2840	2776	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bootstrap\tier0_s64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2776 -s 120
  2⤵
  PID:2840