dc24ff563b1a79792067693f2021ada91531c8c4d4c21053e4a7baff56c2139e

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
04/10/2023, 09:58

Target

1796-370-0x00000000035C0000-0x00000000036F1000-memory.dll
Size

1.2MB
MD5

b5190932eec0ceb18012af556a736a3c
SHA1

cfbe2054ddc943141ea2e01dc250c38b323c9c40
SHA256

dc24ff563b1a79792067693f2021ada91531c8c4d4c21053e4a7baff56c2139e
SHA512

98d326936ba21a7c8360b5d9fe2bcce0ad96817295bd9be405b1c4e73e30a7d8f76fdb9d09c50f5bbda0ee49d48eb3ee5205ce30f5a71814e44af32047cfc92e
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAr1ftxmbfYQJZKani:7I99DEWVtQArZmn0s

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 1180	1524	rundll32.exe	28
PID 1524 wrote to memory of 1180	1524	rundll32.exe	28
PID 1524 wrote to memory of 1180	1524	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-370-0x00000000035C0000-0x00000000036F1000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1524 -s 56
  2⤵
  PID:1180