791373cad86a6bb9ecfae5e3eaacb215cfddc0257d9f757b2c4374fb642b23e7

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
06/10/2023, 20:24

Target

3036-1108-0x0000000002D80000-0x0000000002EB1000-memory.dll
Size

1.2MB
MD5

339993e68708980d24874ffc8172ca04
SHA1

9100332fcdbc458d0fc2e132b9a2a9195f63111e
SHA256

791373cad86a6bb9ecfae5e3eaacb215cfddc0257d9f757b2c4374fb642b23e7
SHA512

5c628ea2f8fb5a2befce2ecb5a8a579d7d012fcca7aeb25fc530e63b3e61ce373899cd7da485b62bf6f43caee647daffcc7646c8fef3a6dbe69340ccab5ce5e8
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAK1ftxmbfYQJZKmcB:7I99DEWVtQAKZmn0z

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2452	1732	rundll32.exe	28
PID 1732 wrote to memory of 2452	1732	rundll32.exe	28
PID 1732 wrote to memory of 2452	1732	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3036-1108-0x0000000002D80000-0x0000000002EB1000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1732 -s 56
  2⤵
  PID:2452