e18199e82430780b69bdc9516405d1088dbdf09ead3b57844d66a8197dace7e4

Analysis

max time kernel
122s
max time network
144s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 10:54

Target

3284-13-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

b28ef294f63d41972d2628629b84e861
SHA1

35f5ee651e576074c4996efcd6a52216be4df903
SHA256

e18199e82430780b69bdc9516405d1088dbdf09ead3b57844d66a8197dace7e4
SHA512

f55e38b37155f08d104f30e807a5364dbbd36b1e0a7943d4d5d2316a69b2c5a07bc26d639669cfef17e9bb6153658f3dad699f2cbeceb9af8d4be12c875f6430
SSDEEP

384:s5Jxayczq7Yjt9lfle9s6PLZx36kYGi8:s5DHYeIlfle9HD7li

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 284	2956	rundll32.exe	28
PID 2956 wrote to memory of 284	2956	rundll32.exe	28
PID 2956 wrote to memory of 284	2956	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3284-13-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2956 -s 56
  2⤵
  PID:284