445887b0e37d978afb3446c87d49d3bcd089cbe50cf6f5ec823bd336dc65e936

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 11:54

Target

2236-18-0x00000000005B0000-0x00000000005FF000-memory.dll
Size

316KB
MD5

c5c34bb5bede7e22c6a1f591ad9c39a3
SHA1

16d13a4c572abf60efcabbe2038e1a53536ac3bc
SHA256

445887b0e37d978afb3446c87d49d3bcd089cbe50cf6f5ec823bd336dc65e936
SHA512

f2801984624300eaf0208a8cccf566671dffb5860a2b7ed8f58e660c452e7ef237fbf7366a9289cef6ba1b4d2239213fb04554665d98fffe73f3329446b69133
SSDEEP

6144:uJqVG5d1IpMyibgkTZI6jHID90aTFr8H/:u3d6tevoxjFra

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 1212	2164	rundll32.exe	27
PID 2164 wrote to memory of 1212	2164	rundll32.exe	27
PID 2164 wrote to memory of 1212	2164	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2236-18-0x00000000005B0000-0x00000000005FF000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2164 -s 56
  2⤵
  PID:1212