9a269b0f7faf6ce7c99a407e5d6108724abd93ce54719f824bf477f997445ebc

Analysis

max time kernel
36s
max time network
24s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 22:43

Target

5024-373-0x0000000002E60000-0x0000000002F91000-memory.dll
Size

1.2MB
MD5

42064e4fa2ec2da365a361d535268f28
SHA1

244f633678589e5b0e0797fa1eda82a93da1f67c
SHA256

9a269b0f7faf6ce7c99a407e5d6108724abd93ce54719f824bf477f997445ebc
SHA512

ab48358241f3438400880bad142393b3eb98a019b784c1b8d75223decd9fe1bfc0d69fc5991c56e5236124bd8b4d9466ad8942d140fe765c9ea75acbad456829
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAU1ftxmbfYQJZKYe7E:7I99DEWVtQAUZmn0T

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 2792	1512	rundll32.exe	29
PID 1512 wrote to memory of 2792	1512	rundll32.exe	29
PID 1512 wrote to memory of 2792	1512	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5024-373-0x0000000002E60000-0x0000000002F91000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1512 -s 56
  2⤵
  PID:2792