7704c2a0e4e9a85af5939f1c281675d9b8f416180bf17095ecb184bfa06e3120

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
01-10-2023 04:01

Target

1732-404-0x0000000003330000-0x0000000003461000-memory.dll
Size

1.2MB
MD5

c37e7f8b6d8fa64a74ff08f3f1d3b7e2
SHA1

34e532dfc5512975ba8869dbb58c6146b6a0b0d2
SHA256

7704c2a0e4e9a85af5939f1c281675d9b8f416180bf17095ecb184bfa06e3120
SHA512

9188b6a647e904a2c2bc85d6c5a10ac8a552f400a136fe97b191fe4c02ca2d03544633952b90ca847bfa233de58c723ddbf7ab4f1e6c2a1a6817cd1aa0a2dc96
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAi1ftxmbfYQJZKqef:7I99DEWVtQAiZmn0t

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2788	2188	rundll32.exe	28
PID 2188 wrote to memory of 2788	2188	rundll32.exe	28
PID 2188 wrote to memory of 2788	2188	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1732-404-0x0000000003330000-0x0000000003461000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2188 -s 56
  2⤵
  PID:2788