76584f599ada6fad16c93b9db66c1e88fdaebc73ec61c73c505e1d628b423cf0

Analysis

max time kernel
19s
max time network
32s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10-10-2023 22:51

Target

1060-377-0x0000000003560000-0x0000000003691000-memory.dll
Size

1.2MB
MD5

244308a32e0e9ca8384b72c917efb800
SHA1

79915c840668debb91551d313116f0318f0dabe1
SHA256

76584f599ada6fad16c93b9db66c1e88fdaebc73ec61c73c505e1d628b423cf0
SHA512

625a906dca2ea06447deda0161910d261d0cc414ead076350b662bfd54a78c455ece8602f034794a46a1568cc6688ed24bfc001a49b5bb1829fbf07bcd817a9f
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAR1ftxmbfYQJZKVJn:7I99DEWVtQARZmn0L

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2676	2648	rundll32.exe	30
PID 2648 wrote to memory of 2676	2648	rundll32.exe	30
PID 2648 wrote to memory of 2676	2648	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1060-377-0x0000000003560000-0x0000000003691000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2648 -s 56
  2⤵
  PID:2676