ed5aacab8732a6c48d625c847d51f5c699424c0bf4e69bd0447e49484d367a50

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
09/10/2023, 09:17

Target

2268-417-0x0000000003360000-0x0000000003491000-memory.dll
Size

1.2MB
MD5

ed1bcfa21bddbb04588f15e0abafd8b9
SHA1

87fd979274f0460f237c37e43d9e4aa3c40bcfa3
SHA256

ed5aacab8732a6c48d625c847d51f5c699424c0bf4e69bd0447e49484d367a50
SHA512

b59b54172cce6057d0edf2dc924c4751fa93d928686b28cc060dd9990e3cee15f504a746b18b42bb55b32c9be0d4c168ca9b07b65e8fc6174938fec92c391cdc
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAx1ftxmbfYQJZKLpc:7I99DEWVtQAxZmn0t

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 2032	1168	rundll32.exe	28
PID 1168 wrote to memory of 2032	1168	rundll32.exe	28
PID 1168 wrote to memory of 2032	1168	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2268-417-0x0000000003360000-0x0000000003491000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1168 -s 56
  2⤵
  PID:2032