69a1681e3f4fb6b83b8e1491252c86a7b88775f913702fff9ad973459eef10f8

Analysis

Target
1404-57-0x0000000010000000-0x000000001000F000-memory.dll
Size 60KB
Sample220407-sdjx1aefhm
SHA256 69a1681e3f4fb6b83b8e1491252c86a7b88775f913702fff9ad973459eef10f8
MD5 6f67832392aba998808a19c8091067e9
SHA1 e20c18fb025ed262e19e4d37abc78320c03b3a31
SHA512 cd53c502a2fc5d68938ca16f22ab9adefcd9e3496325d8808b17b2a6fde6a6d664352b4d36fa92ab137e7abd3bec8f2d8c322d89382bba6ebba11c6b04be5fc9
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4004	3744	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 3744	3728	rundll32.exe	79
PID 3728 wrote to memory of 3744	3728	rundll32.exe	79
PID 3728 wrote to memory of 3744	3728	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1404-57-0x0000000010000000-0x000000001000F000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1404-57-0x0000000010000000-0x000000001000F000-memory.dll,#1
  2⤵
  PID:3744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3744 -s 560
    3⤵
    - Program crash
    PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3744 -ip 3744
1⤵
PID:3564