d16191047b6c5690d518ee74df53d731747cac682283b76a6c4e941034d60ab8

Analysis

Target
1796-57-0x0000000000790000-0x000000000079E000-memory.dll
Size 56KB
Sample220317-llzvvsbbck
SHA256 d16191047b6c5690d518ee74df53d731747cac682283b76a6c4e941034d60ab8
MD5 1bc0a71858c5759193c3b249c4f2794b
SHA1 f3d9590788920c4f413b827548c986f55ba32405
SHA512 0bbe6aa6a9c9065d4b412463f9ab0ec37cea785f389956c4845561d0fef54146a384f34991e8509a26834490d8dd75cea9f02aca49d69d9f4cde4305fe2cd95a
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1524	4920	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 4920	4380	rundll32.exe	81
PID 4380 wrote to memory of 4920	4380	rundll32.exe	81
PID 4380 wrote to memory of 4920	4380	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x0000000000790000-0x000000000079E000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x0000000000790000-0x000000000079E000-memory.dll,#1
  2⤵
  PID:4920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 560
    3⤵
    - Program crash
    PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4920 -ip 4920
1⤵
PID:4660