6a6f3742cd56a06e9677f0f217d9014cc7667476231d46c483c56c332e7be527

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
28-09-2022 13:15

Target

1912-54-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

e7c5a768d91d813b7632dd1465f7651a
SHA1

bd117c942a1e0bb57e8c04bcd15bd1f9928e9c94
SHA256

6a6f3742cd56a06e9677f0f217d9014cc7667476231d46c483c56c332e7be527
SHA512

bd31ec9af5bef494a10d03ae1ce9bd5baf7a129fc0edbdd41652e2464990ddeebcff3e4ba2e0838e63055260f795225c60eb7c483c682dd38d09f2293f00cf4e
SSDEEP

192:hHVMfa7TTCjJSixzPSAA56RCK7Yu/VPgwl5lXBAQYfPq/3Kb:h1Mf0gJSix2AA56RCiZVXzGQYnq/6b

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2028 1056 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2028	1056	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1056 wrote to memory of 2028	1056	rundll32.exe	WerFault.exe
PID 1056 wrote to memory of 2028	1056	rundll32.exe	WerFault.exe
PID 1056 wrote to memory of 2028	1056	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1912-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1056

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1056 -s 56
2⤵
- Program crash
PID:2028