ca2f794c7d3a1e709c9f68ac84e6a6651182ac885e01d712d562484be1879920

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-09-2022 10:48

Target

1824-54-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

f3ed0f2598d14a9cefbbb80bb0617116
SHA1

25cd9b9a1cc227d00916be1c4ee15bbc100327c6
SHA256

ca2f794c7d3a1e709c9f68ac84e6a6651182ac885e01d712d562484be1879920
SHA512

685acf0f9178d99453ac06e67bb44f2601b962aa7fdc87fcb61fc299b9c1ac08c0ef280123509da201d62c551839f65fddc9bb06bbf6f809b3db66b1ddb6db1d
SSDEEP

192:hHVMfa7TTCjJSixzPSAA56RCK7Yu/VPgw+/WVHXBAQYfPq/3Kb:h1Mf0gJSix2AA56RCiZVzGQYnq/6b

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1832 1100 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1832	1100	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1100 wrote to memory of 1832	1100	rundll32.exe	WerFault.exe
PID 1100 wrote to memory of 1832	1100	rundll32.exe	WerFault.exe
PID 1100 wrote to memory of 1832	1100	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1824-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1100

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1100 -s 56
2⤵
- Program crash
PID:1832