3ec2ccad8a83ddad686f0b411d7afb589d515576cc0644c977d3ff72194e713d

Analysis

max time kernel
120s
max time network
140s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 22:49

Target

3804-394-0x00000000034E0000-0x0000000003611000-memory.dll
Size

1.2MB
MD5

ba4a50217b655783d8faf7f42f3df195
SHA1

3a7a00004c89949db6675f9c701973095596cb29
SHA256

3ec2ccad8a83ddad686f0b411d7afb589d515576cc0644c977d3ff72194e713d
SHA512

8d96f530d5c72d7318db9d353af5848f15aa16ec6493b84154f7f38839504dad1c1fa82887af08cc1fd416b2a466c4f16dd2eec1c7f94635052ece6c958dd516
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAJ1ftxmbfYQJZKISRGz:7I99DEWVtQAJZmn0ICG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2672	2976	rundll32.exe	28
PID 2976 wrote to memory of 2672	2976	rundll32.exe	28
PID 2976 wrote to memory of 2672	2976	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3804-394-0x00000000034E0000-0x0000000003611000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2976 -s 56
  2⤵
  PID:2672