ea41d431f575312a2b0629bea4027145e8ecc61a1727615e8a4b9756c73646ba

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
30/09/2023, 08:59

Target

3564-344-0x0000000003560000-0x0000000003691000-memory.dll
Size

1.2MB
MD5

fbe57fac34b298fae9ab393195d5c1fe
SHA1

d28cfe28f1f467167d63ca00b7ed59279ae544be
SHA256

ea41d431f575312a2b0629bea4027145e8ecc61a1727615e8a4b9756c73646ba
SHA512

ebd1d093cdc9ceeee74342aa53bb0a12c82a5744d6dd0d50ff4e4817e4794200b800093a58aac2c2e580899e11617b93f3aa24a9eb06f5880525d282af45cdc2
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAR1ftxmbfYQJZKlJz:7I99DEWVtQARZmn07

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 1200	2388	rundll32.exe	28
PID 2388 wrote to memory of 1200	2388	rundll32.exe	28
PID 2388 wrote to memory of 1200	2388	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3564-344-0x0000000003560000-0x0000000003691000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2388 -s 56
  2⤵
  PID:1200