75f4f9feb2efa5e38f2e352a3da81521d67faf337263c1fbb5268c7012df3950

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 22:34

Target

3980-505-0x0000000002FB0000-0x00000000030E1000-memory.dll
Size

1.2MB
MD5

6f0747c81e3fbceeb618ab7b1b16839f
SHA1

25e190b3eb68d88a27909a3ad5b41b8d065c076f
SHA256

75f4f9feb2efa5e38f2e352a3da81521d67faf337263c1fbb5268c7012df3950
SHA512

1bde30605269153880c75ca1a49119c8d7e50ba0690f95618f429b1aec157b387a655d67e8057990369a2057aec77880a438e91c7fd159102a2e8f4329603d91
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAK1ftxmbfYQJZKI1T:7I99DEWVtQAKZmn0M

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1732	1764	rundll32.exe	28
PID 1764 wrote to memory of 1732	1764	rundll32.exe	28
PID 1764 wrote to memory of 1732	1764	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3980-505-0x0000000002FB0000-0x00000000030E1000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1764 -s 56
  2⤵
  PID:1732