351595dd56ff30024943a91b71291d7f2858702fd9f7b9c6d67ba071df8456c4

Resubmissions

23-03-2024 00:25

02-03-2024 20:18

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
02-03-2024 20:18

Target

2040-68-0x0000000000110000-0x0000000000119000-memory.dll
Size

36KB
MD5

b9012638e830a9463abe8233faacb4cc
SHA1

5592b84f53d5438af898303398024ac9a517bee8
SHA256

351595dd56ff30024943a91b71291d7f2858702fd9f7b9c6d67ba071df8456c4
SHA512

4ec8e522c87da36228c736728625c54dd257bddd3ef3d03c36d9b96d662d42383ce800cdc0de8c61615ecc3cd9d56f8cfca1b5baf2af74f54b60710d3c8163e9
SSDEEP

384:s5Jxayczq7Yjt9lfle9s6PLIpw6kYGi8C:s5DHYeIlfle9HDfiN

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2204 wrote to memory of 2740	2204	rundll32.exe	WerFault.exe
PID 2204 wrote to memory of 2740	2204	rundll32.exe	WerFault.exe
PID 2204 wrote to memory of 2740	2204	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2040-68-0x0000000000110000-0x0000000000119000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2204

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2204 -s 52
2⤵
PID:2740