28291afabc83dfc51d747bb0dac4dd7875bcb16419cf6019e0409da884b3e9d1

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29-09-2022 11:52

Target

3852-132-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

3d27076b4c445e9bafafee309b11248f
SHA1

b8635e54930b3be5394723212dec9aaf9cab47bc
SHA256

28291afabc83dfc51d747bb0dac4dd7875bcb16419cf6019e0409da884b3e9d1
SHA512

4625d3293ad7ca8df8d6a1310fb6f5adad32c1769a111b172798ff5899f5b439794e416fcf17628a0e0d5b9c12a1000348706508d7a3f927bc0078c759bdbf29
SSDEEP

384:h1Mf0gJSix2AA56RCiZVYioKGQYnq/6b:zZeS6AIoiHRjCqi

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1276 1340 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1276	1340	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1340 wrote to memory of 1276	1340	rundll32.exe	WerFault.exe
PID 1340 wrote to memory of 1276	1340	rundll32.exe	WerFault.exe
PID 1340 wrote to memory of 1276	1340	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3852-132-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1340 -s 56
2⤵
- Program crash
PID:1276