6033ce231a777febe6b67b25df249a7f8ab9aa12282c50cd3eeaf57caa1f9f2f

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 16:10

Target

536-55-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

fea290a3fd8b4752a8316fe559ee1d23
SHA1

214d672c501c190aab959d420ebebab2fecbf7b4
SHA256

6033ce231a777febe6b67b25df249a7f8ab9aa12282c50cd3eeaf57caa1f9f2f
SHA512

b0ae0963b3f4f3f6534d0c1677e8d7bef2b9eea775ac2a67af7226255295003af6211db608e49031375634660e703f54069e2418d3ffa780147ce0c9b56563b0
SSDEEP

192:hHVMfa7TTCjJSixzPSAA56RCK7Yu/VPgwfA3XBAQYfPq/3Kb4:h1Mf0gJSix2AA56RCiZVKGQYnq/6b

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
844	1348	WerFault.exe	17

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 844	1348	rundll32.exe	27
PID 1348 wrote to memory of 844	1348	rundll32.exe	27
PID 1348 wrote to memory of 844	1348	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\536-55-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1348 -s 56
  2⤵
  - Program crash
  PID:844