dc96654ca259bd45a3aa5dbb60202d584f9856edeb18a68b8f3b5a4a4b2b4398

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 01:10

Target

1904-575-0x0000000002BA0000-0x0000000002CD1000-memory.dll
Size

1.2MB
MD5

8f7b03a12d6078f584e606332aebe1d2
SHA1

dc1794373c4b2efe1a5d99c3c03145ba8dbf192b
SHA256

dc96654ca259bd45a3aa5dbb60202d584f9856edeb18a68b8f3b5a4a4b2b4398
SHA512

cc64476a70ac06f89da62ce020b1e48f10a4f95d3c47d70bd2f162c271a9138f067ea9d691e6107db42f81626c55f7f6710cd2a99eea9b58e0f7c8d853efc984
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAo1ftxmbfYQJZKsOAL:7I99DEWVtQAoZmn0z

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 1996	2828	rundll32.exe	24
PID 2828 wrote to memory of 1996	2828	rundll32.exe	24
PID 2828 wrote to memory of 1996	2828	rundll32.exe	24

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1904-575-0x0000000002BA0000-0x0000000002CD1000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2828 -s 56
  2⤵
  PID:1996