00d6b64972f028f30fb22d610b49fd42901a4808e03d4a133cf6ff8f37bd0d91

Analysis

max time kernel
117s
max time network
136s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10-10-2023 22:15

Target

1364-723-0x00000000032B0000-0x00000000033E1000-memory.dll
Size

1.2MB
MD5

fb35bd4b8b6d3451de6ada47988247ba
SHA1

3e813aa64870040dc1d207579b3e260c2dad1efa
SHA256

00d6b64972f028f30fb22d610b49fd42901a4808e03d4a133cf6ff8f37bd0d91
SHA512

749d87b307b99250d094bc6da1fad9a5d60c3470ebb41b872329588b6bf3373f057900cf7500a83749fe3be42cc940fc7837fb4ae534c3c1635aa7eb58be24ef
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQA61ftxmbfYQJZK02F:7I99DEWVtQA6Zmn03

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2004	3068	rundll32.exe	28
PID 3068 wrote to memory of 2004	3068	rundll32.exe	28
PID 3068 wrote to memory of 2004	3068	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1364-723-0x00000000032B0000-0x00000000033E1000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3068 -s 56
  2⤵
  PID:2004