7e3e8836488acbaa1ca66ab6e784a71334125c722e1962ab0f13735eeac00f21

Analysis

max time kernel
34s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 12:40

Target

1032-98-0x0000000010000000-0x000000001000E000-memory.dll
Size

56KB
MD5

6e05909fc3bacd7fd338bc9bed907b82
SHA1

a84370b1dbef0978e41bc681aa32268c48afc32b
SHA256

7e3e8836488acbaa1ca66ab6e784a71334125c722e1962ab0f13735eeac00f21
SHA512

07aa5608b19772962ded9c154ff032fcd8c06dc4ea7a437abdce85e62ec3dc7776259ec41b01592c1564d0efda7880e9dcd459f40f18eb18e25ba9f3e29691c8
SSDEEP

1536:KGBx3R60XApqlaPGhVMq2LpeReOb2Pmp:KGBZ00Xfl4OMq2LpeReS2+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2044	832	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 576 wrote to memory of 832	576	rundll32.exe	26
PID 576 wrote to memory of 832	576	rundll32.exe	26
PID 576 wrote to memory of 832	576	rundll32.exe	26
PID 576 wrote to memory of 832	576	rundll32.exe	26
PID 576 wrote to memory of 832	576	rundll32.exe	26
PID 576 wrote to memory of 832	576	rundll32.exe	26
PID 576 wrote to memory of 832	576	rundll32.exe	26
PID 832 wrote to memory of 2044	832	rundll32.exe	27
PID 832 wrote to memory of 2044	832	rundll32.exe	27
PID 832 wrote to memory of 2044	832	rundll32.exe	27
PID 832 wrote to memory of 2044	832	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1032-98-0x0000000010000000-0x000000001000E000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:576
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1032-98-0x0000000010000000-0x000000001000E000-memory.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:832
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 832 -s 196
    3⤵
    - Program crash
    PID:2044

memory/832-55-0x0000000075911000-0x0000000075913000-memory.dmp

Filesize
8KB

Download