868aef2615d5740edc1f8fc656a6ac95bd899ec3f85d459c2f8dc5299d8f56b1

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 20:50

Target

2180-1276-0x00000000034A0000-0x00000000035D1000-memory.dll
Size

1.2MB
MD5

c35bf3498b443a980662237f77ffe4fd
SHA1

509e473f67252d59f57eb45694e3d45f31ac920f
SHA256

868aef2615d5740edc1f8fc656a6ac95bd899ec3f85d459c2f8dc5299d8f56b1
SHA512

55a72358e801dede221a8dae3a088a175df455625a9f1bc924f1241f8e3e0c304910b889fedeef03a16da2d67ea0d43f921032d8b94e36d97c618fb98453a223
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQA11ftxmbfYQJZKfdd:7I99DEWVtQA1Zmn0l

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 1948	1952	rundll32.exe	28
PID 1952 wrote to memory of 1948	1952	rundll32.exe	28
PID 1952 wrote to memory of 1948	1952	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2180-1276-0x00000000034A0000-0x00000000035D1000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1952 -s 56
  2⤵
  PID:1948