de2fdcef24f088a1ed65003f23dacadb9a0f8c0c338fa7bcc2fe9a8cbbe2ec1a

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 06:07

Target

4504-378-0x0000000002CA0000-0x0000000002DD1000-memory.dll
Size

1.2MB
MD5

67683de6ab99b7baa9eaa34f321a81bf
SHA1

3fc6485ccd79a5f8db4d2d90a9e07c0a8e56b1c1
SHA256

de2fdcef24f088a1ed65003f23dacadb9a0f8c0c338fa7bcc2fe9a8cbbe2ec1a
SHA512

76804f01a8cb728d29d311112f171e4cbf94d74e774a0d439b6ab23f1538ff02314550823f63e9723ead8c2e69c016e1d1a160b3a6a58442328eb2f74307ef02
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQA41ftxmbfYQJZKhAeL6:7I99DEWVtQA4Zmn0h/L

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 1720	2264	rundll32.exe	28
PID 2264 wrote to memory of 1720	2264	rundll32.exe	28
PID 2264 wrote to memory of 1720	2264	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4504-378-0x0000000002CA0000-0x0000000002DD1000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2264 -s 56
  2⤵
  PID:1720