3e5d92ed9ff8d3279af41df21608b7f930effe6eca0d9ca198d39174487063e0

Analysis

Target
1816-58-0x000000006EBE0000-0x0000000070FC5000-memory.dll
Size 35.9MB
Sample220321-qm1wrscgam
SHA256 3e5d92ed9ff8d3279af41df21608b7f930effe6eca0d9ca198d39174487063e0
MD5 772c07b287748791e84240275eba8d29
SHA1 46674ef9426a47abf1907aaa0f36b0f645819571
SHA512 dd1629ccd184434da84cf24d98bd5ec5b6b6c65e28fdce263f99ea958025dc79e4cd43f98404789c1fdb6b11e4016bdc58b2db6ecee8582f0d8efcdf42da0671
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1400	368	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 368	3304	rundll32.exe	78
PID 3304 wrote to memory of 368	3304	rundll32.exe	78
PID 3304 wrote to memory of 368	3304	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1816-58-0x000000006EBE0000-0x0000000070FC5000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1816-58-0x000000006EBE0000-0x0000000070FC5000-memory.dll,#1
  2⤵
  PID:368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 368 -s 560
    3⤵
    - Program crash
    PID:1400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 368 -ip 368
1⤵
PID:1152