dbe4bfcec54587629aff611def62a726d0faae2ac3d1603b10b2bb477eb358e3

Resubmissions

02-12-2024 11:16

29-11-2024 12:55

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2144	2632	rundll32.exe	30
PID 2632 wrote to memory of 2144	2632	rundll32.exe	30
PID 2632 wrote to memory of 2144	2632	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aMLjTIhBvevLGx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2632 -s 80
  2⤵
  PID:2144