76571c0d5e25339d2fe80c96a8859e51236cdfa79974ff33a2cb6fd84a641d04

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
26-09-2022 15:58

Target

1212-54-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

a31f141779b07a5a0b7a13766392de08
SHA1

f8048add011e2b259ad64360cfe157fcf88c7ef6
SHA256

76571c0d5e25339d2fe80c96a8859e51236cdfa79974ff33a2cb6fd84a641d04
SHA512

331389025afe8ff6833104df6adefcb61c49042c63074ebcd776a2afa7bcfc2d494450e36005ef83714dce4f56b743d919fd32bfb774d9802005c89fca805d2d
SSDEEP

192:hHVMfa7TTCjJSixzPSAA56RCK7Yu/VPgw9TzHXBAQYfPq/3KbXV:h1Mf0gJSix2AA56RCiZVvfGQYnq/6bl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1204	832	WerFault.exe	20

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1212-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 832 -s 56
  2⤵
  - Program crash
  PID:1204