97b210c6b3acc3c04a51f28b9d61e6bd455ca60a4d893b22f8baa98295aae6c3

Analysis

max time kernel
120s
max time network
135s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 21:56

Target

1940-475-0x0000000002A60000-0x0000000002B91000-memory.dll
Size

1.2MB
MD5

e6d57f88320c7ea2c7818b2f1f7fa88d
SHA1

ae62fce749a2868104e3273d73b154bb1a92a812
SHA256

97b210c6b3acc3c04a51f28b9d61e6bd455ca60a4d893b22f8baa98295aae6c3
SHA512

e4aa5051b00023ad8f87a781e700fff48aedaefb0f4dfa03a3a6e27013dbe9e5279dc9877ed7426aa82b68ea755280d5c58bbeab5e70cdae4baee8663ac188d6
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAU1ftxmbfYQJZK7qv:7I99DEWVtQAUZmn0O

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2088	1948	rundll32.exe	28
PID 1948 wrote to memory of 2088	1948	rundll32.exe	28
PID 1948 wrote to memory of 2088	1948	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1940-475-0x0000000002A60000-0x0000000002B91000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1948 -s 56
  2⤵
  PID:2088