f84f26cae25634edf751391b04fa8fa7b204a85f961fca2829d9f3d0e5f5b6e2

Analysis

max time kernel
119s
max time network
134s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 05:19

Target

4988-426-0x00000000030E0000-0x0000000003211000-memory.dll
Size

1.2MB
MD5

ee3790f3a978373fdc886380b10ffb62
SHA1

f37f7c777540cb809b6fff7f1b9fb43f519f258e
SHA256

f84f26cae25634edf751391b04fa8fa7b204a85f961fca2829d9f3d0e5f5b6e2
SHA512

6c9335eb0cca5bdb7e7531a905c8878bcb6f81cbe0399a20b672b8975563fd85917b20349f06394797d617591185228fc9f3c441f19d75a6979f12e52435e32c
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAJ1ftxmbfYQJZK7Rzq:7I99DEWVtQAJZmn0Vz

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 844	2976	rundll32.exe	28
PID 2976 wrote to memory of 844	2976	rundll32.exe	28
PID 2976 wrote to memory of 844	2976	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4988-426-0x00000000030E0000-0x0000000003211000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2976 -s 56
  2⤵
  PID:844