39d25ae018564c6c2e465a05c6bb33b6b4251c633b4faa558bd5529235c63c6a

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
25/11/2023, 21:35

Target

696-142-0x00000000028C0000-0x0000000002AD8000-memory.dll
Size

2.1MB
MD5

5295c807c10f1633b5bdc3eaf93b4a23
SHA1

f46f5883cbcf6070bf970cd747156c4673ca4159
SHA256

39d25ae018564c6c2e465a05c6bb33b6b4251c633b4faa558bd5529235c63c6a
SHA512

62211308c746b7f23354b8526ce94403aa4b6bbed795e80764a2bdc3a4defc97aff4d6110fab3ef623ac693dbb9de8cd2691719bf21a7d1da5d59e205ff48e0a
SSDEEP

49152:AEwBRVTf0Tk27H1X06kSm9abZ9Zx/B3/4JAs/Xf0zPJ:VwrL27Dkr63/4u

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2020	2196	rundll32.exe	28
PID 2196 wrote to memory of 2020	2196	rundll32.exe	28
PID 2196 wrote to memory of 2020	2196	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\696-142-0x00000000028C0000-0x0000000002AD8000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2196 -s 56
  2⤵
  PID:2020