fa191a0a99f01829ea630f10d355b0a5371eba8efe60e57d9b334dba86b8744c

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04-10-2022 16:01

Target

1724-54-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

f660c4d2f5bd001658530465af60177e
SHA1

a8d24df2db68383d3e4ec26d107c3009a0db6060
SHA256

fa191a0a99f01829ea630f10d355b0a5371eba8efe60e57d9b334dba86b8744c
SHA512

262836abf99ae905a2544cddb23ecf3af2f31e1af7d47d25c905ed4d4ed5e29ffc279febcae26ed7cd8fc81832b1276bf4fef370f7c45ebc6a89f6267a6b7fcb
SSDEEP

192:hHVMfa7TTCjJSixzPSAA56RCK7Yu/VPgwKAXBAQYfPq/3Kb4:h1Mf0gJSix2AA56RCiZV1GQYnq/6b

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1724	1672	WerFault.exe	17

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1724	1672	rundll32.exe	27
PID 1672 wrote to memory of 1724	1672	rundll32.exe	27
PID 1672 wrote to memory of 1724	1672	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1724-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1672 -s 56
  2⤵
  - Program crash
  PID:1724