440c602a56d11806c6896f2e2cc8d04b9849d743875c4032f26391a973373c4f

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 09:52

Target

320-277-0x0000000003280000-0x00000000033B1000-memory.dll
Size

1.2MB
MD5

82dbcddc91c883ece16ab63694f627e1
SHA1

b7cc814c20042679f5ea3ce34ce238036bdbfa40
SHA256

440c602a56d11806c6896f2e2cc8d04b9849d743875c4032f26391a973373c4f
SHA512

d8910cd7081943c1ac54e9d83c6248c4c1097b15f791384c84babed9b87c424b8dfbb36dd2f9d9059100aa86c42ad46bee6ba7228c9b3d2f6e468d22776fa7b9
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAn1ftxmbfYQJZKKj1:7I99DEWVtQAnZmn0o

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 2820	1272	rundll32.exe	28
PID 1272 wrote to memory of 2820	1272	rundll32.exe	28
PID 1272 wrote to memory of 2820	1272	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\320-277-0x0000000003280000-0x00000000033B1000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1272 -s 56
  2⤵
  PID:2820