70ba0a8d83b1319ac07d00c31a67c10f525ec1b076f281aeec89857293657e82

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 08:48

Target

5060-132-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

1c233b0d7f3e5e466e4282b18a6909d4
SHA1

cd2cb95396730c4518559fb36e7edbc47ffe7914
SHA256

70ba0a8d83b1319ac07d00c31a67c10f525ec1b076f281aeec89857293657e82
SHA512

126f16c0d28449aead1ba868db977d812c804f9606c6a23c641669b654101f69cc3861fbe073f4868fd2adff70e6c7bc47b58bd0a2513d9b130611e0b69c85eb
SSDEEP

192:hHVMfa7TTCjJSixzPSAA56RCK7Yu/VPgwk90XBAQYfPq/3Kb:h1Mf0gJSix2AA56RCiZVu9uGQYnq/6b

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2028 1380 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2028	1380	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1380 wrote to memory of 2028	1380	rundll32.exe	WerFault.exe
PID 1380 wrote to memory of 2028	1380	rundll32.exe	WerFault.exe
PID 1380 wrote to memory of 2028	1380	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5060-132-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1380

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1380 -s 56
2⤵
- Program crash
PID:2028