8fbfc25e9b891e4d2921348575c912a6b84d7cbc0d15e54835082a2232e241e5

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 20:49

Target

400-1196-0x00000000035E0000-0x0000000003711000-memory.dll
Size

1.2MB
MD5

1a6a2e1ab7616a4bda4931f1206c8e47
SHA1

4e8b908a8d07e2d449b1951116dd4164c8600346
SHA256

8fbfc25e9b891e4d2921348575c912a6b84d7cbc0d15e54835082a2232e241e5
SHA512

2437cdaa768f4144b43692c0994dbec227e3359bd70502443a14b926f67a586172970c0eb712a1d14d39bfa0568543b7716af32302a182e19ad9a7f1f56d6e22
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAZ1ftxmbfYQJZKiB4:7I99DEWVtQAZZmn0C

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2068	2260	rundll32.exe	28
PID 2260 wrote to memory of 2068	2260	rundll32.exe	28
PID 2260 wrote to memory of 2068	2260	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\400-1196-0x00000000035E0000-0x0000000003711000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2260 -s 56
  2⤵
  PID:2068