db0705e3a6075bd687e60f75970e4f4fa37fe6070d2759a398e87d8c8391e5c7

Analysis

max time kernel
117s
max time network
129s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 01:12

Target

4376-212-0x0000000003750000-0x0000000003881000-memory.dll
Size

1.2MB
MD5

0481aa989f8826449841a339602321f0
SHA1

987e858ae51512aadca427466315fff3a062298c
SHA256

db0705e3a6075bd687e60f75970e4f4fa37fe6070d2759a398e87d8c8391e5c7
SHA512

0c9388856fa3aac6ab681f59871d83b0d250150868792e763aa1c41d0bb4b3d8b7cf3f39a5870dacff299161cf3a7c7dc08148a91b43ccf86f614c61014e242a
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAI1ftxmbfYQJZKhAv:7I99DEWVtQAIZmn0m

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2724	2648	rundll32.exe	29
PID 2648 wrote to memory of 2724	2648	rundll32.exe	29
PID 2648 wrote to memory of 2724	2648	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4376-212-0x0000000003750000-0x0000000003881000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2648 -s 56
  2⤵
  PID:2724