be1b8193f71a1d27303d1c222d7844c8986fd743439008cb937f15ac89433a01

Analysis

max time kernel
122s
max time network
143s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 19:23

Target

3856-281-0x0000000003520000-0x0000000003651000-memory.dll
Size

1.2MB
MD5

0e4f900a3c5baa598c265b09bc68bdb5
SHA1

f47d999af29eb790922092d132f5be4b88d63a5d
SHA256

be1b8193f71a1d27303d1c222d7844c8986fd743439008cb937f15ac89433a01
SHA512

aabb36c40d920ea3bab13a017782cf84e2fe9be780643e69215cdaa5f3c38d34bc00545c643ea8f6fadc2d16b65ac5e9b6856150ae6850f3717730bc33c244af
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAd1ftxmbfYQJZK71I:7I99DEWVtQAdZmn0x

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 2040	1056	rundll32.exe	28
PID 1056 wrote to memory of 2040	1056	rundll32.exe	28
PID 1056 wrote to memory of 2040	1056	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3856-281-0x0000000003520000-0x0000000003651000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1056 -s 56
  2⤵
  PID:2040