ce603e10cc6105357742e3fa511f9d57e37b56809d7c4cad945e67616adec14a

Analysis

max time kernel
122s
max time network
138s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 06:55

Target

268-365-0x0000000003600000-0x0000000003731000-memory.dll
Size

1.2MB
MD5

b28df2d256e550d3c6d4e4dcde11b58d
SHA1

d3c1f90b359040db3989ec360e152a92dbaa2f6f
SHA256

ce603e10cc6105357742e3fa511f9d57e37b56809d7c4cad945e67616adec14a
SHA512

d34c8767386b3e29d6e631756bdd731cdd3c94eb6d73f8e01959fd8246703d165dbe67d22d7ad7c97a59bb113a1107ac45bf35f3dba0ddc6e8276b146c80c309
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQA/1ftxmbfYQJZKrr9:7I99DEWVtQA/Zmn0X

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1068	2012	rundll32.exe	28
PID 2012 wrote to memory of 1068	2012	rundll32.exe	28
PID 2012 wrote to memory of 1068	2012	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\268-365-0x0000000003600000-0x0000000003731000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2012 -s 56
  2⤵
  PID:1068