f2f861e75aa095ddc4660f04cb1b5dbfdd4e5be876723b827caf632660d0b1a3

Analysis

Target

912-57-0x00000000001D0000-0x00000000001D8000-memory.dll
Size

32KB
MD5

49b525bb8690e550c5a79472a07e4eab
SHA1

e2468ab6d9b55b883e1871cbc14663a772154912
SHA256

f2f861e75aa095ddc4660f04cb1b5dbfdd4e5be876723b827caf632660d0b1a3
SHA512

b0bed83e79ca99294fb31341da59b8b272a7369476d0c13caca0ffcd5637286ae54c5159afca17975869eace86aff0f5bbdbf78771aa561f3b01c753ba5e54c8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1008	4092	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 4092	3680	rundll32.exe	80
PID 3680 wrote to memory of 4092	3680	rundll32.exe	80
PID 3680 wrote to memory of 4092	3680	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\912-57-0x00000000001D0000-0x00000000001D8000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\912-57-0x00000000001D0000-0x00000000001D8000-memory.dll,#1
  2⤵
  PID:4092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 560
    3⤵
    - Program crash
    PID:1008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4092 -ip 4092
1⤵
PID:792