d7a6dd6957f075c8274bbdbd4a51da8c2d199b52d47586d201cf0e242b268284

Analysis

Target

1152-57-0x0000000010000000-0x000000001008F000-memory.dll
Size

572KB
MD5

5f7a27362843e108e01c1ab9c369e47c
SHA1

598cd75d8dc5cfa94cea6502eb0fb2dd50716fdb
SHA256

d7a6dd6957f075c8274bbdbd4a51da8c2d199b52d47586d201cf0e242b268284
SHA512

96ff8304310a20048d57c1b83aa76dad5256c8e1398b69d67f2cfcf93019f811b1b506026ccb9313c5f0f426e1e0d3213d89e32d5adb1dded029c85689fd8b85

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1372 3644 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1372	3644	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4688 wrote to memory of 3644	4688	rundll32.exe	rundll32.exe
PID 4688 wrote to memory of 3644	4688	rundll32.exe	rundll32.exe
PID 4688 wrote to memory of 3644	4688	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1152-57-0x0000000010000000-0x000000001008F000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1152-57-0x0000000010000000-0x000000001008F000-memory.dll,#1
  2⤵
  PID:3644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 412
    3⤵
    - Program crash
    PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3644 -ip 3644
1⤵
PID:1848