06e9f2ada33dd98ce8c8377d76771cad840687c073f83898422242d76b2de137

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 06:54

Target

1936-371-0x0000000002710000-0x0000000002841000-memory.dll
Size

1.2MB
MD5

75fcfb28743f28d8cee137bd2f5a9f62
SHA1

683643b1902a499ba182c5f5426ff4099abe9225
SHA256

06e9f2ada33dd98ce8c8377d76771cad840687c073f83898422242d76b2de137
SHA512

cd5840e2472d87f2b560e3e692ec8de8379406c946650690211552910f51406a98ab8e7b47a64a7c82e192e321d3b0e07602e5613a0776337efaf383112abf99
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAR1ftxmbfYQJZK/Xd:7I99DEWVtQARZmn0f

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2480	2244	rundll32.exe	28
PID 2244 wrote to memory of 2480	2244	rundll32.exe	28
PID 2244 wrote to memory of 2480	2244	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1936-371-0x0000000002710000-0x0000000002841000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2244 -s 56
  2⤵
  PID:2480