76584f599ada6fad16c93b9db66c1e88fdaebc73ec61c73c505e1d628b423cf0

Analysis

max time kernel
122s
max time network
141s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 05:03

Target

1060-377-0x0000000003560000-0x0000000003691000-memory.dll
Size

1.2MB
MD5

244308a32e0e9ca8384b72c917efb800
SHA1

79915c840668debb91551d313116f0318f0dabe1
SHA256

76584f599ada6fad16c93b9db66c1e88fdaebc73ec61c73c505e1d628b423cf0
SHA512

625a906dca2ea06447deda0161910d261d0cc414ead076350b662bfd54a78c455ece8602f034794a46a1568cc6688ed24bfc001a49b5bb1829fbf07bcd817a9f
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAR1ftxmbfYQJZKVJn:7I99DEWVtQARZmn0L

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 2580	1768	rundll32.exe	28
PID 1768 wrote to memory of 2580	1768	rundll32.exe	28
PID 1768 wrote to memory of 2580	1768	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1060-377-0x0000000003560000-0x0000000003691000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1768 -s 56
  2⤵
  PID:2580