1fcaa015d5a9826587e882a65a304b6b00cdf4cc52cfd321541de4a4500e9bce

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
03-03-2024 22:53

Target

1700-54-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

eca86688a26809a9e152ebf65e59a707
SHA1

1bdf7829570721d2de601aa1781f2949331f96f7
SHA256

1fcaa015d5a9826587e882a65a304b6b00cdf4cc52cfd321541de4a4500e9bce
SHA512

904c22e920ceb25ea28b711fcf33d09f227993c89937512b0109697e37df9fa6782c6737d3ccfce8a99b96122a461259cdd3f0ff59c25f1e21b3e3ecea896e2e
SSDEEP

384:h1Mf0gJSix2AA56RCiZVQX3GQYnq/6bl:zZeS6AIoiHQHCqi

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 2200	2832	rundll32.exe	28
PID 2832 wrote to memory of 2200	2832	rundll32.exe	28
PID 2832 wrote to memory of 2200	2832	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1700-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2832 -s 52
  2⤵
  PID:2200