93d677bd782e1ddeda7f69f73eefdf04716870849cd5279a0b4d7f08c1cf6ed6

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 05:51

Target

2704-574-0x00000000032E0000-0x0000000003411000-memory.dll
Size

1.2MB
MD5

9af7f3e3f6c5a25b619da555336ea4b7
SHA1

360939418dcf16f18978e3c22882e732c3c048f9
SHA256

93d677bd782e1ddeda7f69f73eefdf04716870849cd5279a0b4d7f08c1cf6ed6
SHA512

f1c063331690868a5089df4e9f101326214ced0bf81e68ffae72184156a679209f0f1bd9320b19c5e7905dc2afafc57f19005d89ce7820809687081c599d63d7
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAp1ftxmbfYQJZK+xW:7I99DEWVtQApZmn0O

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 2204	1716	rundll32.exe	28
PID 1716 wrote to memory of 2204	1716	rundll32.exe	28
PID 1716 wrote to memory of 2204	1716	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2704-574-0x00000000032E0000-0x0000000003411000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1716 -s 56
  2⤵
  PID:2204