e12a44bafadd5cca534500decca51609848ca49708f8c0c142149a8939323963

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 04:07

Target

e12a44bafadd5cca534500decca51609848ca49708f8c0c142149a8939323963.dll
Size

36KB
MD5

c92ac4ab860fc7b2e169b928d36e9c8b
SHA1

373aa256e6cd9546bb1459759747d79bbe48fe03
SHA256

e12a44bafadd5cca534500decca51609848ca49708f8c0c142149a8939323963
SHA512

a178627cf9b3146dd86f947e46bdf9d331ae44d4d40881f1c9c622311e18bcefa07b1fed7a1bcb08a9f6437f75beb26636f4521e3f1e400b85a450f98439411c
SSDEEP

192:hHVMfa7TTCjJSixzPSAA56RCK7Yu/VPgwHXBAQYfPq/3Kb:h1Mf0gJSix2AA56RCiZVdGQYnq/6b

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1296 wrote to memory of 2900	1296	rundll32.exe	WerFault.exe
PID 1296 wrote to memory of 2900	1296	rundll32.exe	WerFault.exe
PID 1296 wrote to memory of 2900	1296	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e12a44bafadd5cca534500decca51609848ca49708f8c0c142149a8939323963.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1296

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1296 -s 52
2⤵
PID:2900