71cec3c65d2f50488c0f1450d1671a59b6a3ef1f764ac621d95118dbe3aa0847

Analysis

max time kernel
122s
max time network
138s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 20:31

Target

2924-973-0x0000000003770000-0x00000000038A1000-memory.dll
Size

1.2MB
MD5

2d5dade0b3be7585286e0c1e979a6ca1
SHA1

8b5dbb26ca57817daaba1117ffde491c223203fd
SHA256

71cec3c65d2f50488c0f1450d1671a59b6a3ef1f764ac621d95118dbe3aa0847
SHA512

fc163308435b041d6e3d17a2545bbbaf4fb80f879ab30926934da5622a03889e0d7bd3d96f5280296d6b3c7c8ff280df383b8078f81ef8aa7b04107fe8865f92
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAW1ftxmbfYQJZK7aKz:7I99DEWVtQAWZmn0t

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 1156	2408	rundll32.exe	28
PID 2408 wrote to memory of 1156	2408	rundll32.exe	28
PID 2408 wrote to memory of 1156	2408	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2924-973-0x0000000003770000-0x00000000038A1000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2408 -s 56
  2⤵
  PID:1156