a845e90a4b53d4cde40172545bd6cd94635cc17de934381c3794218ffe3fe40f

Analysis

max time kernel
33s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24/08/2022, 12:37

Target
956-54-0x0000000180000000-0x0000000180009000-memory.dll
Size 36KB
Sample220824-ptkmpaeea3
SHA256 a845e90a4b53d4cde40172545bd6cd94635cc17de934381c3794218ffe3fe40f
MD5 5f9ea45bd905658efe643aff640ccaba
SHA1 940d29bdf2616ceecdf953c82baebc950be749cb
SHA512 5418d996a62cd469a5ae1afdbb62ffa5a56ce08276ecf1bf9e77632f518093e9bd802fe8b65c5f735015f4de7892105c5538d32ae6ae9a06b0adf25821b8cc55
SSDEEP 192:hHVMfa7TTCjJSixzPSAA56RCK7Yu/VPgwFF3S3XBAQYfPq/3Kb:h1Mf0gJSix2AA56RCiZVvWGQYnq/6b
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
836	368	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 836	368	rundll32.exe	27
PID 368 wrote to memory of 836	368	rundll32.exe	27
PID 368 wrote to memory of 836	368	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\956-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:368
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 368 -s 56
  2⤵
  - Program crash
  PID:836