18a3fa5a9904f2f1988a7269e1eddce0f58d11f174f52ec7ad3cc14bec3269a7

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-09-2022 15:38

Target

832-54-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

c3b996506bd87b609cad14fd20718747
SHA1

874fb9c2012d6812624c7c133985fe989fcfa1b8
SHA256

18a3fa5a9904f2f1988a7269e1eddce0f58d11f174f52ec7ad3cc14bec3269a7
SHA512

09b43ade4b9a4b8c69742d48af85b2b8f68894c7061f1f1727bfa00a09a557945498a37f841974c2dd1c9e026be1268b0249f682252d52dff589ccb2dca65282
SSDEEP

384:h1Mf0gJSix2AA56RCiZVVGbGQYnq/6bl:zZeS6AIoiHV6Cqi

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

900 1212 WerFault.exe rundll32.exe

pid	pid_target	process	target process
900	1212	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1212 wrote to memory of 900	1212	rundll32.exe	WerFault.exe
PID 1212 wrote to memory of 900	1212	rundll32.exe	WerFault.exe
PID 1212 wrote to memory of 900	1212	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\832-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1212

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1212 -s 56
2⤵
- Program crash
PID:900