d45a22a111fb4a5fcb98513a80565faf389885e8e446ae370aa8e1bc3de44515

Analysis

max time kernel
17s
max time network
29s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 21:42

Target

2656-289-0x00000000038E0000-0x0000000003A11000-memory.dll
Size

1.2MB
MD5

821e72d3caf5085828cc53a0e3b632dc
SHA1

03be694d543def14a3c25c8d5e22487643104011
SHA256

d45a22a111fb4a5fcb98513a80565faf389885e8e446ae370aa8e1bc3de44515
SHA512

c1128fb934290608527541cfa8b9d626ded206362bb9fcc8c869d2f94c02ed155254ee90d8eec246dcc5bfd259ab014abdbab5000ba199040af4ee5d0b69d1a7
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAJ1ftxmbfYQJZK1Rp:7I99DEWVtQAJZmn0j

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 1952	1940	rundll32.exe	28
PID 1940 wrote to memory of 1952	1940	rundll32.exe	28
PID 1940 wrote to memory of 1952	1940	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2656-289-0x00000000038E0000-0x0000000003A11000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1940 -s 56
  2⤵
  PID:1952