65bea5f39f1191516f83627161cb38f01f310d546e45caaaa9a94b2c5bc558cd

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
02-10-2023 17:44

Target

584-325-0x0000000003A10000-0x0000000003B41000-memory.dll
Size

1.2MB
MD5

7525dfb5d2e39b5db26a126b3908994b
SHA1

00660794d5ec321d3c8e26ff5f9096154886277e
SHA256

65bea5f39f1191516f83627161cb38f01f310d546e45caaaa9a94b2c5bc558cd
SHA512

f95148f2c3b7449853f3cfef7c0dff4f70c0b7fa04d17badba936810ee1b1085f5bbb1188429c96ffac9c03b5b9e7ad36a4ab7b6d802220ce3cbc59b8f4c65b1
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQA01ftxmbfYQJZKr0Y:7I99DEWVtQA0Zmn0Q

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 1020	796	rundll32.exe	28
PID 796 wrote to memory of 1020	796	rundll32.exe	28
PID 796 wrote to memory of 1020	796	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\584-325-0x0000000003A10000-0x0000000003B41000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:796
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 796 -s 56
  2⤵
  PID:1020