2384aa0e23acdffd949aa037b4e052120b986d63be95e781b4eb7286311c54d4

Analysis

max time kernel
122s
max time network
148s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 22:04

Target

1644-503-0x0000000003740000-0x0000000003871000-memory.dll
Size

1.2MB
MD5

52356d04c74d4f2dd8168a862aaa0885
SHA1

0b4a0e34e358fcb2e1d1a2f58c5c1e2c413c080a
SHA256

2384aa0e23acdffd949aa037b4e052120b986d63be95e781b4eb7286311c54d4
SHA512

c1ff0416a234f981430c7c6941bc39f3669cab57e13c4827cad078f8c619818f2d643c3e4e79d2a656b7742ad4cd8e031a03e28944e198b0bad022c53628d7d7
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAj1ftxmbfYQJZK2P1:7I99DEWVtQAjZmn0g

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2756	2736	rundll32.exe	29
PID 2736 wrote to memory of 2756	2736	rundll32.exe	29
PID 2736 wrote to memory of 2756	2736	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1644-503-0x0000000003740000-0x0000000003871000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2736 -s 56
  2⤵
  PID:2756