877a8f17c46ca07e67ef2ec3e820d42e45de0ca618896f4e250159d3a2028544

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 12:23

Target

2492-270-0x00000000032A0000-0x00000000033D1000-memory.dll
Size

1.2MB
MD5

2db1cfa5478e724b909277d978284e25
SHA1

d6d20e98528c10760a1945bb2a393ea98a5dde1b
SHA256

877a8f17c46ca07e67ef2ec3e820d42e45de0ca618896f4e250159d3a2028544
SHA512

2e7234c5513a5e1f59495fbc2cbcaf9ceb78bcff5214513c38e150ae22ba7e2a3a054639bb68ea50a944b5acb0369105d816b9644d848aef3ad592c50179e11b
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAV1ftxmbfYQJZKe9g:7I99DEWVtQAVZmn0C

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2800	2896	rundll32.exe	28
PID 2896 wrote to memory of 2800	2896	rundll32.exe	28
PID 2896 wrote to memory of 2800	2896	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2492-270-0x00000000032A0000-0x00000000033D1000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2896 -s 56
  2⤵
  PID:2800