68183572cf1310cf85fccf7a3696e4f541f5020f0a48d65ae2d38d9b6f6d13f9

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03-10-2023 14:54

Target

3332-642-0x0000000003900000-0x0000000003A31000-memory.dll
Size

1.2MB
MD5

ad464587e72016d04fe538165d100159
SHA1

3596c7b51e272bd00a91ab62973f096d28f57e18
SHA256

68183572cf1310cf85fccf7a3696e4f541f5020f0a48d65ae2d38d9b6f6d13f9
SHA512

328aba151dfd48bf16296ff1105597dd73d51a196258f3fa1f3b381f102835f8006057d466b1619755a6e0aa22e11c3b08936706d78d0ff437cc9cd1561c40d5
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAv1ftxmbfYQJZKibk:7I99DEWVtQAvZmn0o

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2188	2044	rundll32.exe	28
PID 2044 wrote to memory of 2188	2044	rundll32.exe	28
PID 2044 wrote to memory of 2188	2044	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3332-642-0x0000000003900000-0x0000000003A31000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2044 -s 56
  2⤵
  PID:2188