862c8030d4f30ee13795db85407e2fd6b1a3a55726899a7ae726e2e2be28702f

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07/10/2023, 23:36

Target

1408-463-0x00000000030F0000-0x0000000003221000-memory.dll
Size

1.2MB
MD5

d642e0c952f76ec34047210a9dcc7544
SHA1

5679d6bc5ac1a557468a9aa9e991828d3f51ca56
SHA256

862c8030d4f30ee13795db85407e2fd6b1a3a55726899a7ae726e2e2be28702f
SHA512

06e9837eb13ac494059a6711240cad8c31e8df6ee701cc00baabb657305a42a17f77b5a90b0f4a10709730b8f6aea29d8d20cc66e105709029ae24e0404542f3
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAO1ftxmbfYQJZKdiM:7I99DEWVtQAOZmn04

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 2120	1196	rundll32.exe	28
PID 1196 wrote to memory of 2120	1196	rundll32.exe	28
PID 1196 wrote to memory of 2120	1196	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1408-463-0x00000000030F0000-0x0000000003221000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1196 -s 56
  2⤵
  PID:2120