56d7db62e69143917bc1058e0143763fa6c79f30e561193561d78e4cedfb53c4

Analysis

max time kernel
121s
max time network
146s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 07:49

Target

2112-81-0x00000000031E0000-0x0000000003311000-memory.dll
Size

1.2MB
MD5

151be904d6ffce855069747e43699a20
SHA1

1db57a8b2154b0bfdd61b9003b214fc94270795a
SHA256

56d7db62e69143917bc1058e0143763fa6c79f30e561193561d78e4cedfb53c4
SHA512

9088579e2a340ce61076c4f42b4c39d08b105d9f19fc964c17935ff0fe3743f108811e0e31ad70277cd39d19c0c0deecf097a2a28a32c5af3b75a256442c64ed
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAZ1ftxmbfYQJZKmBX:7I99DEWVtQAZZmn0W

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2360	2080	rundll32.exe	28
PID 2080 wrote to memory of 2360	2080	rundll32.exe	28
PID 2080 wrote to memory of 2360	2080	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2112-81-0x00000000031E0000-0x0000000003311000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2080 -s 56
  2⤵
  PID:2360