dbe4bfcec54587629aff611def62a726d0faae2ac3d1603b10b2bb477eb358e3

Analysis

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2700	2212	rundll32.exe	31
PID 2212 wrote to memory of 2700	2212	rundll32.exe	31
PID 2212 wrote to memory of 2700	2212	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aMLjTIhBvevLGx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2212 -s 80
  2⤵
  PID:2700