1f95f49c2fed61770d92876d95d05657b1bc678f077dff34dbbcba910e068af2

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
07/03/2025, 15:22

Target

Order Specifications/tier0_s64.dll
Size

412KB
MD5

de738f87b7a558476d73d590ea20a3b9
SHA1

ea2da2c8b5c811ea798805d3e77250f12cf6da76
SHA256

87b2d5cd0f667d8f72468ffd146dcf2aebdf7e65db575c04ffe6a4df9c1f1850
SHA512

934a24556d0a4dd7643c03f96cb057ff25bceecbc9795c4a30884aecc5afd441fa99bfe0d978c8879f3fb10260373f055731f51a18775c55de68fa716bccb81b
SSDEEP

6144:xgK7Z8Fd7IQx/XYn7z504xbPnTfMrqS63qqp5WEoXWGhYcRo4gFYRu7oJzBV9:hZ8Fd7IM/Xwnz2qS63nYEe6uo4gxyB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2568	2932	rundll32.exe	30
PID 2932 wrote to memory of 2568	2932	rundll32.exe	30
PID 2932 wrote to memory of 2568	2932	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Order Specifications\tier0_s64.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2932 -s 116
  2⤵
  PID:2568