f2ebbf69771e9512cad5c74268c941786b6a1c25ed281499e7290143a9686039

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07/10/2023, 05:34

Target

4596-10-0x0000000002D50000-0x0000000002E81000-memory.dll
Size

1.2MB
MD5

716173ada6ac60447f0f30fbfb7a3fef
SHA1

d8ab400eddc88449ad64de91671b2dde07c36c5f
SHA256

f2ebbf69771e9512cad5c74268c941786b6a1c25ed281499e7290143a9686039
SHA512

b4e4859cf25548ae503ddbc0a1a20a093ebc976bba799d96af8fee7ea2448de43d3d757506a7704103534db4b7249c1c08f47042e8070566a3cae01975c1a9f6
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAl1ftxmbfYQJZKhWbL4rC:7I99DEWVtQAlZmn0cP4r

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2436	2180	rundll32.exe	28
PID 2180 wrote to memory of 2436	2180	rundll32.exe	28
PID 2180 wrote to memory of 2436	2180	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4596-10-0x0000000002D50000-0x0000000002E81000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2180 -s 56
  2⤵
  PID:2436