e215a97e2bcd9e222cbf2a418cfa8827a1686b84979b4bd700714b87ab9721a3

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
02/10/2023, 03:32

Target

4068-372-0x0000000002CE0000-0x0000000002E11000-memory.dll
Size

1.2MB
MD5

18d8335981ea1cbc7b9a595fb31d1252
SHA1

6b5308ba4dd0d522af683aa9334750a29be14ab7
SHA256

e215a97e2bcd9e222cbf2a418cfa8827a1686b84979b4bd700714b87ab9721a3
SHA512

e6e0219eb60960444e4415e39426a0223508265a20551dc1b4b93d8f3535cc29996561b8395b4cd3f9d72a0ec921c81f9b6dc9476ba93fa1b95f96fb2eb81f53
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAc1ftxmbfYQJZK3JQdO:7I99DEWVtQAcZmn0ZQ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 1988	1692	rundll32.exe	28
PID 1692 wrote to memory of 1988	1692	rundll32.exe	28
PID 1692 wrote to memory of 1988	1692	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4068-372-0x0000000002CE0000-0x0000000002E11000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1692 -s 56
  2⤵
  PID:1988