dd8d3c8d95ae0166b86f926a45c109b838b2bc7739c4c6cd1403eaefb591fd6f

Analysis

Target

2904-2-0x00000000021F0000-0x0000000002409000-memory.dll
Size

2.1MB
MD5

8c33144ffab9202af277c097a65aa29f
SHA1

664b8f79375d699393ddcabd284732a7b5a05eea
SHA256

dd8d3c8d95ae0166b86f926a45c109b838b2bc7739c4c6cd1403eaefb591fd6f
SHA512

9fa97dd6e4be5d2cedf847ddba4f200522e3e58d190c2f6efbb3ef2a3827288f7fab556a8bd6928610b0355549e4196254f0da4b85e6d6a114651708cb400889
SSDEEP

49152:bGgJ3vE7rwsY5+a+h1cHkUnl/u9Zx/PgxeAaENv8+9xrG:NavI5+qHxsgxeAtXrG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 1680	2676	rundll32.exe	30
PID 2676 wrote to memory of 1680	2676	rundll32.exe	30
PID 2676 wrote to memory of 1680	2676	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2904-2-0x00000000021F0000-0x0000000002409000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2676 -s 52
  2⤵
  PID:1680