1cdaf83a5a0a73dce219de1295fb3d4f33e6fcaf63acd68a5ed3a594c9aa21c4

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
04/10/2023, 09:29

Target

1720-1184-0x0000000003720000-0x0000000003851000-memory.dll
Size

1.2MB
MD5

48250917c48a30e1f44f5d9eeba85a57
SHA1

ed9eba2412ac851754643df4e973869473ea6b85
SHA256

1cdaf83a5a0a73dce219de1295fb3d4f33e6fcaf63acd68a5ed3a594c9aa21c4
SHA512

a921042bd0005c74bc01df756d1d22729d15097e95cb7dfb0356b43e78da00fab01838fa9fefec277db5fa23bbb805f7245c983a819e71295818b1935b17aa89
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQA91ftxmbfYQJZKLV/:7I99DEWVtQA9Zmn0B

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 1724	2208	rundll32.exe	28
PID 2208 wrote to memory of 1724	2208	rundll32.exe	28
PID 2208 wrote to memory of 1724	2208	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1720-1184-0x0000000003720000-0x0000000003851000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2208 -s 56
  2⤵
  PID:1724