bec16f7748801eea9207f2db7b18c43ada2b7857c21d54f3801d506e4d27040f

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
27-11-2023 14:52

Target

2912-20-0x0000000002860000-0x0000000002A78000-memory.dll
Size

2.1MB
MD5

150a52d1f3cf16141ec91ad445aece00
SHA1

325864409819fa29efd3d378c4e7447565679e8b
SHA256

bec16f7748801eea9207f2db7b18c43ada2b7857c21d54f3801d506e4d27040f
SHA512

c56a1248a19883be76d167f01137aa4003e9dc02eb58861eaeaecc0f39171d04b5ead1d3c744cae7e790d4a47a726971b9f4b0984c274940d1982d22e5eea930
SSDEEP

49152:AEwBRVTf0Tk27H1X06kSm9abZ9Zx/B3/4Jp0Ptf0MtJ:VwrL27Dkr63/4/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2252	2256	rundll32.exe	28
PID 2256 wrote to memory of 2252	2256	rundll32.exe	28
PID 2256 wrote to memory of 2252	2256	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2912-20-0x0000000002860000-0x0000000002A78000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2256 -s 56
  2⤵
  PID:2252