f5d18974b03f9d715d4ab1397bf23765e0e70c267c2692c25d5422210752a5ba

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/08/2024, 08:48

Target

2404-0-0x0000000000110000-0x0000000000162000-memory.dll
Size

328KB
MD5

0cfd316b5aff875387ac5253bbcc88c5
SHA1

4de2e9c8f9b15ff6bcd44357b7f8afbbb1f5d4f9
SHA256

f5d18974b03f9d715d4ab1397bf23765e0e70c267c2692c25d5422210752a5ba
SHA512

bd40a502a24e330e121758730124c5c5afa98fc26ad7fa07628275666bdfd92e0ee402888af4386d704d120143e539293ea8187c6e4db62fe36a00c85fb60a58
SSDEEP

3072:FzbINhWl+CIbfqqEVxtfg8jtfDCJS4l9JTFyG+JteEzCnLL8qSVdSYJyc6vzHk:FzbUWootfDCvT4ZTXzCLL8nSR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 1428	2124	rundll32.exe	30
PID 2124 wrote to memory of 1428	2124	rundll32.exe	30
PID 2124 wrote to memory of 1428	2124	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2404-0-0x0000000000110000-0x0000000000162000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2124 -s 52
  2⤵
  PID:1428