fd75b86321e3ada7e309432dbee897d8856846741efbe93d11ffa8b2f4e06f6e

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25/08/2022, 12:10

Target
1476-54-0x0000000180000000-0x0000000180009000-memory.dll
Size 36KB
Sample220825-pb5vxadff4
SHA256 fd75b86321e3ada7e309432dbee897d8856846741efbe93d11ffa8b2f4e06f6e
MD5 0a0f69c593c7bdc60c9cab798cceaf22
SHA1 fa276f166e738ef57785c122c1c389d4d5a120c1
SHA512 bb147edde35d87ea9e1b12fe2e8bd4d3152a691cb566cc5470aea35283bb5e4af5970d132017774438a3be2dee8e79729b64624efeb404d635ffe2c0b1d52e8d
SSDEEP 192:hHVMfa7TTCjJSixzPSAA56RCK7Yu/VPgwXudsXBAQYfPq/3Kb:h1Mf0gJSix2AA56RCiZVBhGQYnq/6b
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1884	780	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 1884	780	rundll32.exe	28
PID 780 wrote to memory of 1884	780	rundll32.exe	28
PID 780 wrote to memory of 1884	780	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1476-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 780 -s 56
  2⤵
  - Program crash
  PID:1884