aedb0cd0e58beb59dd88e64bccd21cf8cf240a3b7cb8d0b34aabb68278254967

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 06:54

Target

2076-373-0x00000000035E0000-0x0000000003711000-memory.dll
Size

1.2MB
MD5

d0a038660fec7d4376add1cf2c0cf6e9
SHA1

331521873073dc75255e83640be20845c35f1c47
SHA256

aedb0cd0e58beb59dd88e64bccd21cf8cf240a3b7cb8d0b34aabb68278254967
SHA512

905ab1398e974713c9c6fe711e9b3703b4b8506253c056d0b7117154d0c6f695bdd9aca1f87e62c66fca97d0e2b8018cc49a3a6b4babce6ce1787f1d8c678149
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAZ1ftxmbfYQJZKnBN:7I99DEWVtQAZZmn0B

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2068	2272	rundll32.exe	28
PID 2272 wrote to memory of 2068	2272	rundll32.exe	28
PID 2272 wrote to memory of 2068	2272	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2076-373-0x00000000035E0000-0x0000000003711000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2272 -s 56
  2⤵
  PID:2068