69a1681e3f4fb6b83b8e1491252c86a7b88775f913702fff9ad973459eef10f8

Analysis

Target

1404-57-0x0000000010000000-0x000000001000F000-memory.dll
Size

60KB
MD5

6f67832392aba998808a19c8091067e9
SHA1

e20c18fb025ed262e19e4d37abc78320c03b3a31
SHA256

69a1681e3f4fb6b83b8e1491252c86a7b88775f913702fff9ad973459eef10f8
SHA512

cd53c502a2fc5d68938ca16f22ab9adefcd9e3496325d8808b17b2a6fde6a6d664352b4d36fa92ab137e7abd3bec8f2d8c322d89382bba6ebba11c6b04be5fc9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4004	3744	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 3744	3728	rundll32.exe	79
PID 3728 wrote to memory of 3744	3728	rundll32.exe	79
PID 3728 wrote to memory of 3744	3728	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1404-57-0x0000000010000000-0x000000001000F000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1404-57-0x0000000010000000-0x000000001000F000-memory.dll,#1
  2⤵
  PID:3744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3744 -s 560
    3⤵
    - Program crash
    PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3744 -ip 3744
1⤵
PID:3564