fcc746ee961c5a52c6d92525758dfac0ea07b81850999215b28b814fe8663a58

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 09:52

Target

3004-81-0x00000000030E0000-0x0000000003211000-memory.dll
Size

1.2MB
MD5

b7111df58b5d7307b5fcd55c85bebf2b
SHA1

ba07f15e14e52a4fab60d95390bd6c1c8ccab5ad
SHA256

fcc746ee961c5a52c6d92525758dfac0ea07b81850999215b28b814fe8663a58
SHA512

07989e2aa061925e77d7f112327fb325e3f0f38092b9ebfd8905a5e2dd3c836e83b30c395c5bdf3b4a792982bce939a1bc8b022a81318a63427bfd6a059e6b39
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAJ1ftxmbfYQJZKWRz+:7I99DEWVtQAJZmn02z

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2892	1728	rundll32.exe	23
PID 1728 wrote to memory of 2892	1728	rundll32.exe	23
PID 1728 wrote to memory of 2892	1728	rundll32.exe	23

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3004-81-0x00000000030E0000-0x0000000003211000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1728 -s 56
  2⤵
  PID:2892