bb4d60861e39fec5660e8d03e61d78cfb6e6855ec93a6125bcc76ba77cc7aadc

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 00:26

Target

4432-266-0x0000000002D90000-0x0000000002EC1000-memory.dll
Size

1.2MB
MD5

43aa625701aba95044c7f24bbb0bdac2
SHA1

8282c306bf16f08feb6b690a2da1cc363e6fadf1
SHA256

bb4d60861e39fec5660e8d03e61d78cfb6e6855ec93a6125bcc76ba77cc7aadc
SHA512

dd43a457e61e50aae7c63f47da8731c8e1b2fee66ed080b4d65c7f41f1aa1b0c87fe964e6575d1be1b56fbbc65540ec7f83f17abfe1f68805dc71c329a895652
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAZ1ftxmbfYQJZKwfU:7I99DEWVtQAZZmn0m

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1224	2228	rundll32.exe	28
PID 2228 wrote to memory of 1224	2228	rundll32.exe	28
PID 2228 wrote to memory of 1224	2228	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4432-266-0x0000000002D90000-0x0000000002EC1000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2228 -s 56
  2⤵
  PID:1224