ae3f6738280cc7a684b54f9fb0a27a29c32e19c390cf764667c71727f0e5c7d3

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 06:30

Target

1888-364-0x0000000002B10000-0x0000000002C41000-memory.dll
Size

1.2MB
MD5

d8d69e59b62968ba6d53088d8158c306
SHA1

4dda93ed5090fcd1dea221b1d1a10db3dc29ffec
SHA256

ae3f6738280cc7a684b54f9fb0a27a29c32e19c390cf764667c71727f0e5c7d3
SHA512

a39962010e1bfa3c5436dee6395cf65ec73033c062d4c5de73577662758d8534e125a47561ff7fee687229a7f27c24019f2c700d59917326ee2059ecd1c5081e
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAR1ftxmbfYQJZK7XT:7I99DEWVtQARZmn0T

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2184	2188	rundll32.exe	28
PID 2188 wrote to memory of 2184	2188	rundll32.exe	28
PID 2188 wrote to memory of 2184	2188	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1888-364-0x0000000002B10000-0x0000000002C41000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2188 -s 56
  2⤵
  PID:2184