9d9e26ecf69f1205ed30bf602dc9b148e6d049a956ed8644eb143523eec947cf

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18/10/2022, 14:04

Target

1708-54-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

d8308d284b95b8d1220dfd9840cd05f3
SHA1

b707ffec4b1ac680866ac5269908ec656335b34e
SHA256

9d9e26ecf69f1205ed30bf602dc9b148e6d049a956ed8644eb143523eec947cf
SHA512

704d6a4f51641608ce347e1984ac40722a9e509c0cf012025f301a600fdeadf3dd3f315b3f54e40b86e9d9737f13d02d7094cfe0f2c1bb5d6103db50b7877b99
SSDEEP

192:hHVMfa7TTCjJSixzPSAA56RCK7Yu/VPgw3XBAQYfPq/3Kb:h1Mf0gJSix2AA56RCiZV9GQYnq/6b

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1996	1980	WerFault.exe	21

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1996	1980	rundll32.exe	28
PID 1980 wrote to memory of 1996	1980	rundll32.exe	28
PID 1980 wrote to memory of 1996	1980	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1708-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1980 -s 56
  2⤵
  - Program crash
  PID:1996