6e92ab15039a177a25ae4cfa7b2210b0ba3122a08b27d3f1b2c9dd9088f096b7

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-09-2022 15:41

Target

1088-54-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

ff3ffd36a32cc4a24422ecea98eb4a82
SHA1

bb86b8ae0b1746aa32da094102db3cfbe43e0507
SHA256

6e92ab15039a177a25ae4cfa7b2210b0ba3122a08b27d3f1b2c9dd9088f096b7
SHA512

fa26a1aab35581d4b4fa1fe33c6e9dff23e03dbe1a8966343571403dfe65ed419b650c064d06cbe7f8fad23aff28f2a19eda39f9427d500629901b69e06be4d1
SSDEEP

384:h1Mf0gJSix2AA56RCiZVH3yYGQYnq/6bl:zZeS6AIoiHXLCqi

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

704 1840 WerFault.exe rundll32.exe

pid	pid_target	process	target process
704	1840	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1840 wrote to memory of 704	1840	rundll32.exe	WerFault.exe
PID 1840 wrote to memory of 704	1840	rundll32.exe	WerFault.exe
PID 1840 wrote to memory of 704	1840	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1088-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1840

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1840 -s 56
2⤵
- Program crash
PID:704