069de728af43dd80bf134d1a33819cdb070be2055096e6c163405122b1ee2cbe

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
02/10/2023, 11:12

Target

320-1150-0x0000000003670000-0x00000000037A1000-memory.dll
Size

1.2MB
MD5

35c89362757543481cbf76a9443e6354
SHA1

11d845490c790f95d131189c88239c70b36b0e8a
SHA256

069de728af43dd80bf134d1a33819cdb070be2055096e6c163405122b1ee2cbe
SHA512

fb5252a313e01f949b2fc9bc25faaa2fb087d722dd0bb3417455bb594aefefb310d1ea4890c3a585be79276792ddd25756e6ea3d2ac1db694500972efd888ad2
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAG1ftxmbfYQJZKEBI8:7I99DEWVtQAGZmn0j

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2820	2228	rundll32.exe	28
PID 2228 wrote to memory of 2820	2228	rundll32.exe	28
PID 2228 wrote to memory of 2820	2228	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\320-1150-0x0000000003670000-0x00000000037A1000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2228 -s 56
  2⤵
  PID:2820