fdcd11dcd6a96d4ddfefaef7a186277e84c147fa7e33c0994b2deb384e8d0487

Analysis

max time kernel
90s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
25/03/2025, 20:59

Target

tier0_s64.dll
Size

412KB
MD5

de738f87b7a558476d73d590ea20a3b9
SHA1

ea2da2c8b5c811ea798805d3e77250f12cf6da76
SHA256

87b2d5cd0f667d8f72468ffd146dcf2aebdf7e65db575c04ffe6a4df9c1f1850
SHA512

934a24556d0a4dd7643c03f96cb057ff25bceecbc9795c4a30884aecc5afd441fa99bfe0d978c8879f3fb10260373f055731f51a18775c55de68fa716bccb81b
SSDEEP

6144:xgK7Z8Fd7IQx/XYn7z504xbPnTfMrqS63qqp5WEoXWGhYcRo4gFYRu7oJzBV9:hZ8Fd7IM/Xwnz2qS63nYEe6uo4gxyB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2968	2532	rundll32.exe	30
PID 2532 wrote to memory of 2968	2532	rundll32.exe	30
PID 2532 wrote to memory of 2968	2532	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\tier0_s64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2532 -s 116
  2⤵
  PID:2968