3546077ada98a9ebf2394870272bc38fd25aa5444ea2c8da67d1942dba453f82

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
05/10/2023, 19:51

Target

1780-101-0x00000000035C0000-0x00000000036F1000-memory.dll
Size

1.2MB
MD5

9dae94576358870075e0d5529eb51508
SHA1

0e7c2700c1d95e2ffe0681d688e1e53fb419bb1a
SHA256

3546077ada98a9ebf2394870272bc38fd25aa5444ea2c8da67d1942dba453f82
SHA512

09f3daa8cb9d813ef8cc0c37270c2e41c56baadc8af341ecf292fc3f4a08d191e2f346ed3b3f86a44c35956a01d2a74ee85e5d0061186333681b97ef063ce400
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAr1ftxmbfYQJZKPnk:7I99DEWVtQArZmn0v

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 900	2372	rundll32.exe	28
PID 2372 wrote to memory of 900	2372	rundll32.exe	28
PID 2372 wrote to memory of 900	2372	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1780-101-0x00000000035C0000-0x00000000036F1000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2372 -s 56
  2⤵
  PID:900