f8e0d5b17719fff8fa04f50c64d234e6aaf2ceaf1165e66fac9e6e751ac5583f

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 06:58

Target

1484-362-0x0000000003560000-0x0000000003691000-memory.dll
Size

1.2MB
MD5

81c42236dd7e50aec6a7eb370a03f46e
SHA1

fa63452d0aeecaec061b12f691449022a651c7e7
SHA256

f8e0d5b17719fff8fa04f50c64d234e6aaf2ceaf1165e66fac9e6e751ac5583f
SHA512

24995c43cb28ce76e3af3acb24ee23ec14c311cc31a0e49b61dd9fd51648a41ce9a6b232f60b7bb21305235b7090753c0f83f9d658a6e360264423d1168034e9
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAR1ftxmbfYQJZKQJO:7I99DEWVtQARZmn0U

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 3036	2160	rundll32.exe	28
PID 2160 wrote to memory of 3036	2160	rundll32.exe	28
PID 2160 wrote to memory of 3036	2160	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1484-362-0x0000000003560000-0x0000000003691000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2160 -s 56
  2⤵
  PID:3036