cabeeecbe2fa94d199de52b342f89cb165b3cd15e94c17d2b707a04ed711e370

Analysis

max time kernel
119s
max time network
135s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 09:48

Target

2692-91-0x00000000031E0000-0x0000000003311000-memory.dll
Size

1.2MB
MD5

5531cee372eb056954a4e5a5745d25bb
SHA1

e54a8e0dba4e65d06c05244327c3864b6483a13f
SHA256

cabeeecbe2fa94d199de52b342f89cb165b3cd15e94c17d2b707a04ed711e370
SHA512

c684da7a8bb9706a04920b0a5f379432216d0365af8dc6f5d8d6c03d86000bba35765b7e3bcb95afaf7a01bec68e99ec930fa9d1ad77ee2a317b97714e50ef34
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAZ1ftxmbfYQJZKYB1:7I99DEWVtQAZZmn00

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 1976	2024	rundll32.exe	27
PID 2024 wrote to memory of 1976	2024	rundll32.exe	27
PID 2024 wrote to memory of 1976	2024	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2692-91-0x00000000031E0000-0x0000000003311000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2024 -s 56
  2⤵
  PID:1976