9fde7c9619042adc2f045629217b672316468b32c1322aa98f538b6cf09ebf5f

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-09-2022 17:41

Target

280-243-0x0000000004090000-0x00000000042E4000-memory.dll
Size

2.3MB
MD5

e522814cf9e3d760f48d32bd57fc9a28
SHA1

50dc2f1e8b5e68bf5892bdc91e0b1984810a4860
SHA256

9fde7c9619042adc2f045629217b672316468b32c1322aa98f538b6cf09ebf5f
SHA512

e71fb98443e19793c184f6bc9ab566a32375bec4e2591d75e18f181515596afd2a157f423d07736947fe5b4fefe71ab51b15ea8eb6242813648186c0ff98af77
SSDEEP

49152:SrZMWwR6g9A2nsk2ttP5S14cDeouSNhcK68x/tDzATkV:SrZM9Yga2sh3c14c9ujCDz

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1932 1360 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1932	1360	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1512 wrote to memory of 1360	1512	rundll32.exe	rundll32.exe
PID 1512 wrote to memory of 1360	1512	rundll32.exe	rundll32.exe
PID 1512 wrote to memory of 1360	1512	rundll32.exe	rundll32.exe
PID 1512 wrote to memory of 1360	1512	rundll32.exe	rundll32.exe
PID 1512 wrote to memory of 1360	1512	rundll32.exe	rundll32.exe
PID 1512 wrote to memory of 1360	1512	rundll32.exe	rundll32.exe
PID 1512 wrote to memory of 1360	1512	rundll32.exe	rundll32.exe
PID 1360 wrote to memory of 1932	1360	rundll32.exe	WerFault.exe
PID 1360 wrote to memory of 1932	1360	rundll32.exe	WerFault.exe
PID 1360 wrote to memory of 1932	1360	rundll32.exe	WerFault.exe
PID 1360 wrote to memory of 1932	1360	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\280-243-0x0000000004090000-0x00000000042E4000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1512

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\280-243-0x0000000004090000-0x00000000042E4000-memory.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 196
3⤵
- Program crash
PID:1932

memory/1360-54-0x0000000000000000-mapping.dmp

Download
memory/1360-55-0x00000000756A1000-0x00000000756A3000-memory.dmp

Filesize
8KB

Download
memory/1932-56-0x0000000000000000-mapping.dmp

Download