041a5a07009a242534cfb2f2ce7bc426f3c87f97eb0ec81b027029cccf811da8

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07/10/2023, 01:48

Target

1044-337-0x0000000002D50000-0x0000000002E81000-memory.dll
Size

1.2MB
MD5

1f579dfc05280fddeb7f2092ebe2f3dc
SHA1

24774a6b13aa5fba606c134f85b43fa894f1c917
SHA256

041a5a07009a242534cfb2f2ce7bc426f3c87f97eb0ec81b027029cccf811da8
SHA512

d633a66d6be0b0314bb78dddfc1dcdb20f80255f8232ac064d6761143e385027ccd43d32c8d82e4f8721f2a3136345696493c3cf9fbd42f25ef34bc22540c415
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAl1ftxmbfYQJZKKWbL4rY:7I99DEWVtQAlZmn0HP4r

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2880	3028	rundll32.exe	28
PID 3028 wrote to memory of 2880	3028	rundll32.exe	28
PID 3028 wrote to memory of 2880	3028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1044-337-0x0000000002D50000-0x0000000002E81000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3028 -s 56
  2⤵
  PID:2880