a9ec1b1eb2e78a1e441c7556bf181b7930862d611c858d888c0ee5e8dcef77a3

Analysis

max time kernel
47s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 08:05

Target

1412-132-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

a0f9a3f45a41da735e54ef6064246a00
SHA1

778fbed426582b98c5de68904ebb8d34db23defc
SHA256

a9ec1b1eb2e78a1e441c7556bf181b7930862d611c858d888c0ee5e8dcef77a3
SHA512

7fb873dbf03ee13474cf3972908e23297ed71817e54770508ce9725d4446ef81ddfe4673b629f56bd3de165af078f915afa8a5334169c5657e5fe17e06587a9d
SSDEEP

192:hHVMfa7TTCjJSixzPSAA56RCK7Yu/VPgw0fBQK+XBAQYfPq/3Kb:h1Mf0gJSix2AA56RCiZVW3sGQYnq/6b

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1672 1380 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1672	1380	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1380 wrote to memory of 1672	1380	rundll32.exe	WerFault.exe
PID 1380 wrote to memory of 1672	1380	rundll32.exe	WerFault.exe
PID 1380 wrote to memory of 1672	1380	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1412-132-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1380

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1380 -s 56
2⤵
- Program crash
PID:1672