82943d94355690901fc9859dea0db9c753faf7e2436c04eb7818bd8b3ad4fff8

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25-07-2024 01:24

Target

3056-0-0x00000000001D0000-0x00000000001D7000-memory.dll
Size

28KB
MD5

8712ad20da98e86bf72ce7e0769184e9
SHA1

c5d55638e0919431ee0c8dba1a7d3e683e69c436
SHA256

82943d94355690901fc9859dea0db9c753faf7e2436c04eb7818bd8b3ad4fff8
SHA512

043d27520b76e72f64142ae429b08be7c0d45044890f2db9c2b0c1f653ea16b3790ef3004e5c1ce039e1629eb1fcb1a3c24da04402bbec3dd74a947e95b08872
SSDEEP

192:NA2vUz9V5Znb4/bxJBJTFpmwF7Pki7rt:NBUzj5Zn61JB9mwtt7r

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 1356	2680	rundll32.exe	30
PID 2680 wrote to memory of 1356	2680	rundll32.exe	30
PID 2680 wrote to memory of 1356	2680	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3056-0-0x00000000001D0000-0x00000000001D7000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2680 -s 52
  2⤵
  PID:1356