69a1681e3f4fb6b83b8e1491252c86a7b88775f913702fff9ad973459eef10f8

Analysis

Target

1404-57-0x0000000010000000-0x000000001000F000-memory.dll
Size

60KB
MD5

6f67832392aba998808a19c8091067e9
SHA1

e20c18fb025ed262e19e4d37abc78320c03b3a31
SHA256

69a1681e3f4fb6b83b8e1491252c86a7b88775f913702fff9ad973459eef10f8
SHA512

cd53c502a2fc5d68938ca16f22ab9adefcd9e3496325d8808b17b2a6fde6a6d664352b4d36fa92ab137e7abd3bec8f2d8c322d89382bba6ebba11c6b04be5fc9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1340	1268	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 1268	1384	rundll32.exe	27
PID 1384 wrote to memory of 1268	1384	rundll32.exe	27
PID 1384 wrote to memory of 1268	1384	rundll32.exe	27
PID 1384 wrote to memory of 1268	1384	rundll32.exe	27
PID 1384 wrote to memory of 1268	1384	rundll32.exe	27
PID 1384 wrote to memory of 1268	1384	rundll32.exe	27
PID 1384 wrote to memory of 1268	1384	rundll32.exe	27
PID 1268 wrote to memory of 1340	1268	rundll32.exe	28
PID 1268 wrote to memory of 1340	1268	rundll32.exe	28
PID 1268 wrote to memory of 1340	1268	rundll32.exe	28
PID 1268 wrote to memory of 1340	1268	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1404-57-0x0000000010000000-0x000000001000F000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1404-57-0x0000000010000000-0x000000001000F000-memory.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 196
    3⤵
    - Program crash
    PID:1340

memory/1268-55-0x0000000075A31000-0x0000000075A33000-memory.dmp

Filesize
8KB

Download