7753a5b649b0b09bd83e56291978bd7abe6f10c1ca962786f083dbdef714432e

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
01-10-2023 15:47

Target

2004-738-0x00000000033D0000-0x0000000003501000-memory.dll
Size

1.2MB
MD5

77a61978e170f4701a6f2ba6ec771d87
SHA1

2c82df8ae26b2d1873d6678b501aa21c03a1d74b
SHA256

7753a5b649b0b09bd83e56291978bd7abe6f10c1ca962786f083dbdef714432e
SHA512

ecdbf5758fda6702e828e8ff37f6366f654f6f72c02e66c475392fe00f04a3c775c4a054f7472ea9ff8784fa3cd5592a2519c68d7121fe41af58aea70a1bdc83
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAQ1ftxmbfYQJZKqo1:7I99DEWVtQAQZmn0j

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 1736	1300	rundll32.exe	28
PID 1300 wrote to memory of 1736	1300	rundll32.exe	28
PID 1300 wrote to memory of 1736	1300	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2004-738-0x00000000033D0000-0x0000000003501000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1300 -s 56
  2⤵
  PID:1736