646f6b497c5054bcb9a9e2241cabfe304dc4004796a0d21fe6250352bb5598d7

Analysis

max time kernel
33s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 08:00

Target

864-54-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

31aed8815db91eee801317d68cb58cfc
SHA1

b7f583c9ac78ef03df791f2230f12e6f8db4a519
SHA256

646f6b497c5054bcb9a9e2241cabfe304dc4004796a0d21fe6250352bb5598d7
SHA512

374444cd89d135fb30bba140194ac2b584bcebe3e706c356102d5831305995686375fdf4a671d829ee1fbfb6f8a9228ecb71114b80e28abfe4498eaabe8e5b30
SSDEEP

192:hHVMfa7TTCjJSixzPSAA56RCK7Yu/VPgwbwwXBAQYfPq/3KbyM:h1Mf0gJSix2AA56RCiZVFwCGQYnq/6b

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1020 1788 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1020	1788	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1788 wrote to memory of 1020	1788	rundll32.exe	WerFault.exe
PID 1788 wrote to memory of 1020	1788	rundll32.exe	WerFault.exe
PID 1788 wrote to memory of 1020	1788	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\864-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1788

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1788 -s 56
2⤵
- Program crash
PID:1020