f6dd315ca926950853cfd5d4b202d01f7ce13571e0179167405e232064789ca4

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 20:19

Target

2636-735-0x0000000002E40000-0x0000000002F71000-memory.dll
Size

1.2MB
MD5

54df036b15b8018680dd47523c0353fd
SHA1

d11454dd8eb5e6d7c01e6c43aade6c366a43ab17
SHA256

f6dd315ca926950853cfd5d4b202d01f7ce13571e0179167405e232064789ca4
SHA512

48b1045e7e266fa7e6e5a199f6660b3356f4afa634e285bace5c7b189398014ebab887db64438522f553f8e5a106e045467760a25f34e1f325f2736843e76bac
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQA21ftxmbfYQJZK04rCf:7I99DEWVtQA2Zmn0hrC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2112	2096	rundll32.exe	28
PID 2096 wrote to memory of 2112	2096	rundll32.exe	28
PID 2096 wrote to memory of 2112	2096	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2636-735-0x0000000002E40000-0x0000000002F71000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2096 -s 56
  2⤵
  PID:2112