0effd7596713b75d23e412b42eef23055f0e44bba7e2b283e6c053d90c75e1fa

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/03/2025, 01:04

Target

RFQ-ELITE INDUSTRIAL MARINE PROJECT/tier0_s64.dll
Size

412KB
MD5

de738f87b7a558476d73d590ea20a3b9
SHA1

ea2da2c8b5c811ea798805d3e77250f12cf6da76
SHA256

87b2d5cd0f667d8f72468ffd146dcf2aebdf7e65db575c04ffe6a4df9c1f1850
SHA512

934a24556d0a4dd7643c03f96cb057ff25bceecbc9795c4a30884aecc5afd441fa99bfe0d978c8879f3fb10260373f055731f51a18775c55de68fa716bccb81b
SSDEEP

6144:xgK7Z8Fd7IQx/XYn7z504xbPnTfMrqS63qqp5WEoXWGhYcRo4gFYRu7oJzBV9:hZ8Fd7IM/Xwnz2qS63nYEe6uo4gxyB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 2080	2828	rundll32.exe	28
PID 2828 wrote to memory of 2080	2828	rundll32.exe	28
PID 2828 wrote to memory of 2080	2828	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\RFQ-ELITE INDUSTRIAL MARINE PROJECT\tier0_s64.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2828 -s 116
  2⤵
  PID:2080