5126379962961347c0573fa2de2de95b0cdb75d636fd0e39c345fb1d967b54d5

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 21:59

Target

3812-62-0x0000016FCB300000-0x0000016FCB314000-memory.dll
Size

80KB
MD5

58bcc0b37adbf8aa0862f79d547c9b92
SHA1

9b0573efa4c4189c6041bf4c89b9ad853c76b81e
SHA256

5126379962961347c0573fa2de2de95b0cdb75d636fd0e39c345fb1d967b54d5
SHA512

9459802f50897aa6f32b394df23cb8be59702ffb82b04716f8beadc6ca8d01866a7c9a979abb5bace075af984afbb5a2ed1642613f490d5755ba961e5da689d3
SSDEEP

768:HCIo0O99dyYus8VIEfuNtxv4c/HFGKndcHrqWwf8D5zf72961rGGQxNVURoI:iaO9qYVXtv4c/HFGL2f8D532aGGXR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2528	2884	rundll32.exe	28
PID 2884 wrote to memory of 2528	2884	rundll32.exe	28
PID 2884 wrote to memory of 2528	2884	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3812-62-0x0000016FCB300000-0x0000016FCB314000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2884 -s 52
  2⤵
  PID:2528