9e1239e68e0509132434c9d38a941efc7335ef44d3b7bde465953acad266bada

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 05:32

Target

2868-1045-0x0000000003590000-0x00000000036C1000-memory.dll
Size

1.2MB
MD5

93e2cdc5ec128aec00e913680c0f3b41
SHA1

cabf64420caf9084553775ef79044c74c5a22e08
SHA256

9e1239e68e0509132434c9d38a941efc7335ef44d3b7bde465953acad266bada
SHA512

826487f085119181b89721e95c1ee4eb48fa0ce108f20fdc15922b39a81dbeeaa31324b013e47864d9639a5150cb0dee389faaffe9a7bf8cf7e7391526f5f94e
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAs1ftxmbfYQJZKIsr:7I99DEWVtQAsZmn05

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 1408	2976	rundll32.exe	28
PID 2976 wrote to memory of 1408	2976	rundll32.exe	28
PID 2976 wrote to memory of 1408	2976	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2868-1045-0x0000000003590000-0x00000000036C1000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2976 -s 56
  2⤵
  PID:1408