695f2fdaf8310b30138e2e67d241d58eaf99ca1c15300319b2fa6a44fdb43511

Analysis

max time kernel
48s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
26/09/2022, 18:13

Target

1660-54-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

84a5133a4a60c0f77ef4eb10c120e196
SHA1

38668820dcecc5ffeaf1aebde1221c5d23f3990c
SHA256

695f2fdaf8310b30138e2e67d241d58eaf99ca1c15300319b2fa6a44fdb43511
SHA512

1b9e1e358a9a1147813ac1609073a919715098d3bee455a7092f4fd62a5cd3b925b4f9aee9506695aef30d9b5dfc41f5126e126b70f1196345c7da20fcb37e74
SSDEEP

192:hHVMfa7TTCjJSixzPSAA56RCK7Yu/VPgw2dCXBAQYfPq/3KbXV:h1Mf0gJSix2AA56RCiZVHGQYnq/6bl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
840	1376	WerFault.exe	18

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 840	1376	rundll32.exe	26
PID 1376 wrote to memory of 840	1376	rundll32.exe	26
PID 1376 wrote to memory of 840	1376	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1660-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1376 -s 56
  2⤵
  - Program crash
  PID:840