d3c2b666190656df9596c8cac83c0a12ada082b2e521ed708dcda1e40bcbbb4e

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18/10/2022, 16:12

Target

332-98-0x0000000000260000-0x0000000000289000-memory.dll
Size

164KB
MD5

7292bb90f0ea8d8d4cdf47c553f7d701
SHA1

4df9f498ea583dec85f0698e9532031d35369ef1
SHA256

d3c2b666190656df9596c8cac83c0a12ada082b2e521ed708dcda1e40bcbbb4e
SHA512

5a3c9e1843425182c6fe61f1721901aa00279f623377f4af73aa69629f6ad0660d2501a36244e5edec5fbd868b22189f209f24ebc2e6183b3cd6775ef19761a5
SSDEEP

3072:B5mdm9v/xM0/f6QvANJIeH34TBf97/6oPO/ya:v9vJM0/bYNJFH34TBV7/vW/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1176	1384	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 1384	1112	rundll32.exe	26
PID 1112 wrote to memory of 1384	1112	rundll32.exe	26
PID 1112 wrote to memory of 1384	1112	rundll32.exe	26
PID 1112 wrote to memory of 1384	1112	rundll32.exe	26
PID 1112 wrote to memory of 1384	1112	rundll32.exe	26
PID 1112 wrote to memory of 1384	1112	rundll32.exe	26
PID 1112 wrote to memory of 1384	1112	rundll32.exe	26
PID 1384 wrote to memory of 1176	1384	rundll32.exe	27
PID 1384 wrote to memory of 1176	1384	rundll32.exe	27
PID 1384 wrote to memory of 1176	1384	rundll32.exe	27
PID 1384 wrote to memory of 1176	1384	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\332-98-0x0000000000260000-0x0000000000289000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\332-98-0x0000000000260000-0x0000000000289000-memory.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 196
    3⤵
    - Program crash
    PID:1176

memory/1384-55-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download