1fcaa015d5a9826587e882a65a304b6b00cdf4cc52cfd321541de4a4500e9bce

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
03-03-2024 22:53

Target

1700-54-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

eca86688a26809a9e152ebf65e59a707
SHA1

1bdf7829570721d2de601aa1781f2949331f96f7
SHA256

1fcaa015d5a9826587e882a65a304b6b00cdf4cc52cfd321541de4a4500e9bce
SHA512

904c22e920ceb25ea28b711fcf33d09f227993c89937512b0109697e37df9fa6782c6737d3ccfce8a99b96122a461259cdd3f0ff59c25f1e21b3e3ecea896e2e
SSDEEP

384:h1Mf0gJSix2AA56RCiZVQX3GQYnq/6bl:zZeS6AIoiHQHCqi

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2832 wrote to memory of 2200	2832	rundll32.exe	WerFault.exe
PID 2832 wrote to memory of 2200	2832	rundll32.exe	WerFault.exe
PID 2832 wrote to memory of 2200	2832	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1700-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2832

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2832 -s 52
2⤵
PID:2200