c4d7645bd3bdc764246a1760d46b2910665054dbd32cd9fcd3ba62bc45dfb3b1

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 06:54

Target

2152-1208-0x0000000003440000-0x0000000003571000-memory.dll
Size

1.2MB
MD5

995aa7eb90526ed900d5b56b80c5499e
SHA1

c9faa51b7be60b1b8c99d078cf682d052fd00de7
SHA256

c4d7645bd3bdc764246a1760d46b2910665054dbd32cd9fcd3ba62bc45dfb3b1
SHA512

2c68adebb96e226435e8ec9bb2fae4a691d112142eecff32abfb5a66c56d6bd2b6f7e2c8cef65e75be45afcc52a9f707f97873bf5b7c175767ee4069668daca6
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAz1ftxmbfYQJZKX/a:7I99DEWVtQAzZmn0v

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 1308	2288	rundll32.exe	28
PID 2288 wrote to memory of 1308	2288	rundll32.exe	28
PID 2288 wrote to memory of 1308	2288	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2152-1208-0x0000000003440000-0x0000000003571000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2288 -s 56
  2⤵
  PID:1308