5eb4fbdb9c5406f34b9d01145adf4815e845f188dc2f5267163052b58e45b80c

Analysis

max time kernel
118s
max time network
129s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 00:58

Target

3592-364-0x0000000002C50000-0x0000000002D81000-memory.dll
Size

1.2MB
MD5

2116440647a363130d53fe6304ff71f5
SHA1

6e0aa40c2e4868234dfb226659e98a07815805e0
SHA256

5eb4fbdb9c5406f34b9d01145adf4815e845f188dc2f5267163052b58e45b80c
SHA512

8a548d80b2d5dc3fc86202bda9d8a5e9fea82c762b89c5fb6ee6ffd818c7c744191b32553687f668b8bcaf5d3bc1cf4e25f43cffd163e68c8e096c0f6bf48cf9
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAV1ftxmbfYQJZKO7V:7I99DEWVtQAVZmn0k

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 3000	2416	rundll32.exe	28
PID 2416 wrote to memory of 3000	2416	rundll32.exe	28
PID 2416 wrote to memory of 3000	2416	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3592-364-0x0000000002C50000-0x0000000002D81000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2416 -s 56
  2⤵
  PID:3000