08ca57936646c48d58933558a50c1c1fc320610265089251cc7611c333c36fae

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
20-09-2023 20:00

Target

4136-367-0x0000000002DE0000-0x0000000002F11000-memory.dll
Size

1.2MB
MD5

cdeda3af14ee1f61471bcebe742bab6e
SHA1

65187f162e0dc80bff44020a3842c501f527bfc3
SHA256

08ca57936646c48d58933558a50c1c1fc320610265089251cc7611c333c36fae
SHA512

f633242b7e8b389408cfa7b3a7be3cae22f54a548f484f12e312f6dd043d9cd39f79ba0e7f7c35cd977747c7221159296a39f249a44b55053cfa4b2533be97bc
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAs1ftxmbfYQJZKGyt:7I99DEWVtQAsZmn0l

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 1212	2188	rundll32.exe	28
PID 2188 wrote to memory of 1212	2188	rundll32.exe	28
PID 2188 wrote to memory of 1212	2188	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4136-367-0x0000000002DE0000-0x0000000002F11000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2188 -s 56
  2⤵
  PID:1212