a0be5b3fa29c9fb3652b74130d6e8dea5a9e08d09e771a535a4e1499f9781ed5

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
30/09/2023, 03:27

Target

4760-329-0x0000000003480000-0x00000000035B1000-memory.dll
Size

1.2MB
MD5

05c5c760e89511ee2b4a5eb9fb118711
SHA1

dcfb9f88244a25936e5b1f41e7503b0dbe85b742
SHA256

a0be5b3fa29c9fb3652b74130d6e8dea5a9e08d09e771a535a4e1499f9781ed5
SHA512

b29e5d3dfafe79ab307f40ed9c71c7b71a576c4a01aa3d714c935347b0b958909a4106aef1f6afbda1b2bb2cbbd2a9f17ee7498ce7f722ad269e03a86136eba0
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAH1ftxmbfYQJZKnD0:7I99DEWVtQAHZmn0D

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 3036	2304	rundll32.exe	28
PID 2304 wrote to memory of 3036	2304	rundll32.exe	28
PID 2304 wrote to memory of 3036	2304	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4760-329-0x0000000003480000-0x00000000035B1000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2304 -s 56
  2⤵
  PID:3036