31602f9bdaf12ad29bcc7641f30011b6b0312c60ae70ee3aaca0d5ccfaab3938

Analysis

max time kernel
122s
max time network
134s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 05:32

Target

572-1048-0x00000000036C0000-0x00000000037F1000-memory.dll
Size

1.2MB
MD5

6585f652dc51d1f73e551684f19e2fe6
SHA1

a2a481f12a98e68c50ce7795fb7d3af7cb8de831
SHA256

31602f9bdaf12ad29bcc7641f30011b6b0312c60ae70ee3aaca0d5ccfaab3938
SHA512

d385623b2a467f480a810658113a0050068f469aee346cd69a4bcab57a0aa18d2c33e69d3794a5aefeaaefe99c31743909ec8410e6eb318848f4244aaf6c981c
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQA71ftxmbfYQJZKRXT:7I99DEWVtQA7Zmn0p

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 1212	2448	rundll32.exe	28
PID 2448 wrote to memory of 1212	2448	rundll32.exe	28
PID 2448 wrote to memory of 1212	2448	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\572-1048-0x00000000036C0000-0x00000000037F1000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2448 -s 56
  2⤵
  PID:1212