0b8634c35359f94334243cae53fd57d6ce86b2b6eeaa4a472f48bb197c155f73

Analysis

max time kernel
118s
max time network
144s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 00:34

Target

3892-421-0x00000000036B0000-0x00000000037E1000-memory.dll
Size

1.2MB
MD5

b0a7be4a54862e27f2e287ae12be98fd
SHA1

efe2a1871b893e4cb4fda15adc8b76c255115600
SHA256

0b8634c35359f94334243cae53fd57d6ce86b2b6eeaa4a472f48bb197c155f73
SHA512

558869a1e014f6192939f711223d7b9b7f9bea0b887dfddd6a4836ec33ac3e9c1459e32f0b358fe3f45037cc29c29b6028742d5f79c9a502f6fa5b08c8bc71b3
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQA61ftxmbfYQJZKu2S:7I99DEWVtQA6Zmn0Z

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 2604	2608	rundll32.exe	21
PID 2608 wrote to memory of 2604	2608	rundll32.exe	21
PID 2608 wrote to memory of 2604	2608	rundll32.exe	21

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3892-421-0x00000000036B0000-0x00000000037E1000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2608 -s 56
  2⤵
  PID:2604