ef78f61143277814502e39fdb0f3e3cbad0d9fc5858b2606bc8b814e24c68e43

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 01:32

Target

1360-208-0x0000000002AB0000-0x0000000002BE1000-memory.dll
Size

1.2MB
MD5

733e93257da7dbf1d797382cb52039e6
SHA1

c27a0078b1d58522e57dfd2f9c9f45797c56f72d
SHA256

ef78f61143277814502e39fdb0f3e3cbad0d9fc5858b2606bc8b814e24c68e43
SHA512

65657e2ffd75dbf23d15ea2610fd077d53ce00f2b6a5e9b33f2b105879158efe82d0893d24a5a428c9862e716b12fded7d10501a2e670953339fb250611449b0
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAH1ftxmbfYQJZK/R8:7I99DEWVtQAHZmn05

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2268	2320	rundll32.exe	28
PID 2320 wrote to memory of 2268	2320	rundll32.exe	28
PID 2320 wrote to memory of 2268	2320	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1360-208-0x0000000002AB0000-0x0000000002BE1000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2320 -s 56
  2⤵
  PID:2268