fa389d6ceb24feda976b0de57698918267c59319fee0032fac7226c5fa30b758

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 01:10

Target

1604-318-0x00000000031D0000-0x0000000003301000-memory.dll
Size

1.2MB
MD5

23e7b4db8f99fb402dc52f6c100c4521
SHA1

a6dcb6a48d466ea6f6fdf6c942a02ab9449d3d91
SHA256

fa389d6ceb24feda976b0de57698918267c59319fee0032fac7226c5fa30b758
SHA512

a6fb94e0c00f0247d0f2ab3afb784da2f19c64b7903fb07cf72d7f0ae3771c634b50d364b56d44180480802bb3b18f9493f96cb8efb5276538b09d7b72da982c
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAw1ftxmbfYQJZKsIh:7I99DEWVtQAwZmn0Z

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2444	2420	rundll32.exe	28
PID 2420 wrote to memory of 2444	2420	rundll32.exe	28
PID 2420 wrote to memory of 2444	2420	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1604-318-0x00000000031D0000-0x0000000003301000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2420 -s 56
  2⤵
  PID:2444