67ab63e4ca29294f0860d7f77f21e6e545c70eb719e7d1c5d13f8a5586941b0c

Analysis

max time kernel
118s
max time network
139s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 20:46

Target

3620-610-0x0000000003330000-0x0000000003461000-memory.dll
Size

1.2MB
MD5

960b92eb57ff0f89c0666d290d90a7d2
SHA1

ec4c65e65d6ff9075b621df72f7eb01d038ad77a
SHA256

67ab63e4ca29294f0860d7f77f21e6e545c70eb719e7d1c5d13f8a5586941b0c
SHA512

274d5511f02bb6be2009f3609d1f44d21a60db43ba0a5252763efd4fbd66c4f529f9d9c1dab939dab9861de5e3e93cef59fcf69cd2b5b3496d211d1b07807a47
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAi1ftxmbfYQJZKTeJ:7I99DEWVtQAiZmn0q

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2184	1956	rundll32.exe	28
PID 1956 wrote to memory of 2184	1956	rundll32.exe	28
PID 1956 wrote to memory of 2184	1956	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3620-610-0x0000000003330000-0x0000000003461000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1956 -s 56
  2⤵
  PID:2184