2ebfb25dd6790457191c6d541e92b02c3463f04f993966881ac9a95f7b830e05

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
04/10/2023, 18:30

Target

2720-540-0x0000000003480000-0x00000000035B1000-memory.dll
Size

1.2MB
MD5

ee3789c5f88b27068f23d13a41516af0
SHA1

f1a84e11775c590ee6215664c4b229ddc8217e91
SHA256

2ebfb25dd6790457191c6d541e92b02c3463f04f993966881ac9a95f7b830e05
SHA512

0339fb1d1cdaa93df7a252aa534e637716e8d510aa3b0155772835ab067501aab47f24d55d222a92493452a31a9326bd5c7ad5ad99eb604b89986528b57bf02c
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAH1ftxmbfYQJZKKDW:7I99DEWVtQAHZmn0I

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2192	1924	rundll32.exe	28
PID 1924 wrote to memory of 2192	1924	rundll32.exe	28
PID 1924 wrote to memory of 2192	1924	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2720-540-0x0000000003480000-0x00000000035B1000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1924 -s 56
  2⤵
  PID:2192