615dd41707af9736ba4eeb08a0797395a0edc6fd605718a965c5029cbafe5818

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
21/03/2025, 01:05

Target

tier0_s64.dll
Size

412KB
MD5

de738f87b7a558476d73d590ea20a3b9
SHA1

ea2da2c8b5c811ea798805d3e77250f12cf6da76
SHA256

87b2d5cd0f667d8f72468ffd146dcf2aebdf7e65db575c04ffe6a4df9c1f1850
SHA512

934a24556d0a4dd7643c03f96cb057ff25bceecbc9795c4a30884aecc5afd441fa99bfe0d978c8879f3fb10260373f055731f51a18775c55de68fa716bccb81b
SSDEEP

6144:xgK7Z8Fd7IQx/XYn7z504xbPnTfMrqS63qqp5WEoXWGhYcRo4gFYRu7oJzBV9:hZ8Fd7IM/Xwnz2qS63nYEe6uo4gxyB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2336	2312	rundll32.exe	30
PID 2312 wrote to memory of 2336	2312	rundll32.exe	30
PID 2312 wrote to memory of 2336	2312	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\tier0_s64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2312 -s 116
  2⤵
  PID:2336