aa2529711549a7da75779aac1218dd8e57c0b0cf73f7470e3b33bcfe52458c06

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 21:54

Target

2928-965-0x00000000036D0000-0x0000000003801000-memory.dll
Size

1.2MB
MD5

e77f55813926908493c49619ab01857a
SHA1

5127a909898a8a7a1dcee30ab7f62a635acd561b
SHA256

aa2529711549a7da75779aac1218dd8e57c0b0cf73f7470e3b33bcfe52458c06
SHA512

0513a54cc0c82b795e8dfe3ad1c5c81d294c2bce8455798b7a3e002e134d437a0a15af53fc95e21e053ed6fc5c8d782965f6f6b933db76efe451a0d58a94d860
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAA1ftxmbfYQJZKPYe:7I99DEWVtQAAZmn0A

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 2456	1276	rundll32.exe	28
PID 1276 wrote to memory of 2456	1276	rundll32.exe	28
PID 1276 wrote to memory of 2456	1276	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2928-965-0x00000000036D0000-0x0000000003801000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1276 -s 56
  2⤵
  PID:2456