24369216b77efb6030f6cf51583e6303926e2ce6d961753ea2f06fdcd4d3a871

Analysis

max time kernel
118s
max time network
151s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 01:13

Target

3740-555-0x0000000003120000-0x0000000003251000-memory.dll
Size

1.2MB
MD5

b70339345a61a78cad95c8a1679b44d5
SHA1

32013c9ed4d2ac01fe39cd0f633e9f891e9196bb
SHA256

24369216b77efb6030f6cf51583e6303926e2ce6d961753ea2f06fdcd4d3a871
SHA512

b202f3060fa19b2c92220efcc06e2b98459e0eae5c61c0daa3cd03c4d0098a6dea74687d68802db76056de28f86c1379cf5584fab3fafeeb39ef90861cc6d579
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAd1ftxmbfYQJZKIedOxiDLoDr5dlzZokmFF117bfH:7I99DEWVtQAdZmn0IedOxiDLoDr5dlz8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2640	1712	rundll32.exe	28
PID 1712 wrote to memory of 2640	1712	rundll32.exe	28
PID 1712 wrote to memory of 2640	1712	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3740-555-0x0000000003120000-0x0000000003251000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1712 -s 56
  2⤵
  PID:2640