dbe4bfcec54587629aff611def62a726d0faae2ac3d1603b10b2bb477eb358e3

Resubmissions

02-12-2024 11:16

29-11-2024 12:55

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2760	2692	rundll32.exe	31
PID 2692 wrote to memory of 2760	2692	rundll32.exe	31
PID 2692 wrote to memory of 2760	2692	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aMLjTIhBvevLGx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2692 -s 80
  2⤵
  PID:2760