90dd57e0f274cc0d843b2466160674395306aaa6353c18ead7b863dfc75ba28d

Analysis

max time kernel
119s
max time network
130s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 17:43

Target

1744-426-0x0000000003610000-0x0000000003741000-memory.dll
Size

1.2MB
MD5

953c3ddc3f102ac033a87ac2584827e8
SHA1

a43cffc83804eb8dc878332c01d7a9b1dc8304a8
SHA256

90dd57e0f274cc0d843b2466160674395306aaa6353c18ead7b863dfc75ba28d
SHA512

e74cbe8b4ec7eba144fb97b257327d0e972f218bf166361f631e15e54fd99c21b0ed5dd273c88a6a88e849424ab474808fb89a7e63159d0c4af853ec5baf0070
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQA01ftxmbfYQJZKJ0x:7I99DEWVtQA0Zmn0i

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2548	2076	rundll32.exe	28
PID 2076 wrote to memory of 2548	2076	rundll32.exe	28
PID 2076 wrote to memory of 2548	2076	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1744-426-0x0000000003610000-0x0000000003741000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2076 -s 56
  2⤵
  PID:2548