3c12c79486f13c973e550baa52dfdc8fd94d34e68dcfd388b19f2ebbae431017

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
05/03/2025, 18:05 UTC

Target

MACHINE SPECIFICATION/tier0_s64.dll
Size

412KB
MD5

de738f87b7a558476d73d590ea20a3b9
SHA1

ea2da2c8b5c811ea798805d3e77250f12cf6da76
SHA256

87b2d5cd0f667d8f72468ffd146dcf2aebdf7e65db575c04ffe6a4df9c1f1850
SHA512

934a24556d0a4dd7643c03f96cb057ff25bceecbc9795c4a30884aecc5afd441fa99bfe0d978c8879f3fb10260373f055731f51a18775c55de68fa716bccb81b
SSDEEP

6144:xgK7Z8Fd7IQx/XYn7z504xbPnTfMrqS63qqp5WEoXWGhYcRo4gFYRu7oJzBV9:hZ8Fd7IM/Xwnz2qS63nYEe6uo4gxyB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2456	2108	rundll32.exe	31
PID 2108 wrote to memory of 2456	2108	rundll32.exe	31
PID 2108 wrote to memory of 2456	2108	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MACHINE SPECIFICATION\tier0_s64.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2108 -s 116
  2⤵
  PID:2456