59ea22dab64ac99dfa15ab98278bea927889d5276f2f0154f51787c5ac7c9310

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 13:51

Target

2184-0-0x0000000000290000-0x00000000002E2000-memory.dll
Size

328KB
MD5

a7593d15de0d27509e29cf5d3be26b4a
SHA1

0eaaeb7756e61abab4e60dfd76c96659927e8c42
SHA256

59ea22dab64ac99dfa15ab98278bea927889d5276f2f0154f51787c5ac7c9310
SHA512

b7857d47a8b5e4358ad0805ea34dad9e6139e268a7c02af0e42ea5be9d9cf7a6801943563a61bf39818de1a9c25bdb5e82138d8231d80f60fcab5aaf3bc5155b
SSDEEP

3072:9zbINhWl+CIbfqqEVxtfg8jtfDCJS4l9JTFyG+JteEzCnL5A/I07pdoYJX6vzHk:9zbUWootfDCvT4ZTXzCL2w0zoF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2156 wrote to memory of 2400	2156	rundll32.exe	WerFault.exe
PID 2156 wrote to memory of 2400	2156	rundll32.exe	WerFault.exe
PID 2156 wrote to memory of 2400	2156	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2184-0-0x0000000000290000-0x00000000002E2000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2156 -s 52
2⤵
PID:2400