a9ef8fc6a6c6a8587832a761829a2df312c912227d74ff69ccbb9d2f6afb8cec

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 20:29

Target

2628-1017-0x0000000003820000-0x0000000003951000-memory.dll
Size

1.2MB
MD5

287c857977c48eea105b0b8013a0f765
SHA1

8cfb403112df5a29cac06ed42a78735ec5b57f67
SHA256

a9ef8fc6a6c6a8587832a761829a2df312c912227d74ff69ccbb9d2f6afb8cec
SHA512

64cdbaab792404bee9269d780fc3ba1b9de810e55f4a24926eade8b0bbd51acb3c55f8a1559979200d26587fb0cf08eab1f50aa0f7637d9884dbebab82204618
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAN1ftxmbfYQJZK3lm:7I99DEWVtQANZmn01

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 3060	2408	rundll32.exe	28
PID 2408 wrote to memory of 3060	2408	rundll32.exe	28
PID 2408 wrote to memory of 3060	2408	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2628-1017-0x0000000003820000-0x0000000003951000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2408 -s 56
  2⤵
  PID:3060