0e8fb7c07f311bacaf5d875db9cad74b315f0cafbf9e88c4fb5b97a6f131cfe4

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-03-2024 10:36

Target

3612-137-0x000001E993670000-0x000001E993679000-memory.dll
Size

36KB
MD5

caae77466dbab96ea25d6ca51fa78cd9
SHA1

6d787a580db67bf6aab9d0771ce7e99bc6e292ca
SHA256

0e8fb7c07f311bacaf5d875db9cad74b315f0cafbf9e88c4fb5b97a6f131cfe4
SHA512

85fb311e1eadc5155596cfa9342f3445c509d63bfe3e4fccc8eca41b030ea081fa1f9255d3aef27901448047dc4b7df3586b02271b739846aadcae816b490ebc
SSDEEP

192:6P+nM5KC/zxayGc3gzq7YjDaqzJCueT+RfbZne9s6PLuZbP0tkYGijY:s5Jxayczq7Yjt9lfle9s6PLy6kYGi8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2876 wrote to memory of 2256	2876	rundll32.exe	WerFault.exe
PID 2876 wrote to memory of 2256	2876	rundll32.exe	WerFault.exe
PID 2876 wrote to memory of 2256	2876	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3612-137-0x000001E993670000-0x000001E993679000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2876

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2876 -s 52
2⤵
PID:2256