af2df88f02fbc44aba3133e4e3b0d54ccd9d3f566fa8c91de4c545d6a83cc68d

Analysis

max time kernel
240s
max time network
291s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 12:06

Target

3848-10-0x0000000003140000-0x0000000003271000-memory.dll
Size

1.2MB
MD5

c365e93c3bd6317ef3eb02f098e47938
SHA1

07518e568db5a1c1f38c0dcf87beb0ae57680411
SHA256

af2df88f02fbc44aba3133e4e3b0d54ccd9d3f566fa8c91de4c545d6a83cc68d
SHA512

df68865660caf5574b59d62307beaf65371ccc5b55feb1b6e8f68c74cef288b6a45a1f5a68fa23862187ef18e7850847e8a4ee923a93098ba49c583a24f4437e
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAD1ftxmbfYQJZK5v0:7I99DEWVtQADZmn0Z

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 1572	2656	rundll32.exe	26
PID 2656 wrote to memory of 1572	2656	rundll32.exe	26
PID 2656 wrote to memory of 1572	2656	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3848-10-0x0000000003140000-0x0000000003271000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2656 -s 56
  2⤵
  PID:1572