76a881453cf34a44569829a21c99f0f6e50d3729310103fd46def2350a1d55a7

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
20/09/2023, 17:29

Target

2212-379-0x0000000002C10000-0x0000000002D41000-memory.dll
Size

1.2MB
MD5

29619d6f00f50f188dbc826d1b35301b
SHA1

141c625fba2b60a16ceb6faebe42a2c6b9afba29
SHA256

76a881453cf34a44569829a21c99f0f6e50d3729310103fd46def2350a1d55a7
SHA512

bbd2c0dfa57fc2b754a338053287d1f25d4e6b4f119755acb8d82762c7246100f080fca7116caafd518087a2a44188633658281c1216a239baea77d435532558
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAh1ftxmbfYQJZKeHV:7I99DEWVtQAhZmn0Y

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 3060	2408	rundll32.exe	28
PID 2408 wrote to memory of 3060	2408	rundll32.exe	28
PID 2408 wrote to memory of 3060	2408	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2212-379-0x0000000002C10000-0x0000000002D41000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2408 -s 56
  2⤵
  PID:3060