dac80242b5ff33944befe806a67ada55538c9e23e2b638df813479321a2df7a5

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 05:32

Target

1776-355-0x0000000003730000-0x0000000003861000-memory.dll
Size

1.2MB
MD5

c2260073ced785b2e5fc093db8ed8cfa
SHA1

c80dc1b6aa1fc01f2ffe474f8e6f02d2bb48deb4
SHA256

dac80242b5ff33944befe806a67ada55538c9e23e2b638df813479321a2df7a5
SHA512

d9f26b8647d04e18e4d678f7f3d771862382e6e2bffa5dd6df9efe8eb4c63590598a54fd90b618957083150fe1cbe4b148ff247e14c266722217ae41a5862336
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAi1ftxmbfYQJZKde6:7I99DEWVtQAiZmn0c

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 1936	3004	rundll32.exe	27
PID 3004 wrote to memory of 1936	3004	rundll32.exe	27
PID 3004 wrote to memory of 1936	3004	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1776-355-0x0000000003730000-0x0000000003861000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3004 -s 56
  2⤵
  PID:1936