0a1dc5772d98ac01b72ef470a27da837b91c59dadea580d28989d919dfc9b34e

Analysis

max time kernel
38s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
31/10/2022, 18:41

Target

916-57-0x0000000000AD0000-0x0000000000AFA000-memory.dll
Size

168KB
MD5

179be88405db306b365964acf56b01fd
SHA1

cecf0eba35ea441e58825775336a7ba52997c1ed
SHA256

0a1dc5772d98ac01b72ef470a27da837b91c59dadea580d28989d919dfc9b34e
SHA512

2291e16d9db0ce3f58b162168759442402acf8d8e69d47463bac4c043979344e619df94bc0878c8f4f5980b2531ac51d676a72dd0298a806fefbab8295f23ef7
SSDEEP

3072:h/Xk0Q8NYgQ9Fu8/uVZAEJswlwgTBfpfg8QO/yaUX1:/Q+8/uVyEJPlwgTBhfrz/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1560	1628	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1628	1788	rundll32.exe	27
PID 1788 wrote to memory of 1628	1788	rundll32.exe	27
PID 1788 wrote to memory of 1628	1788	rundll32.exe	27
PID 1788 wrote to memory of 1628	1788	rundll32.exe	27
PID 1788 wrote to memory of 1628	1788	rundll32.exe	27
PID 1788 wrote to memory of 1628	1788	rundll32.exe	27
PID 1788 wrote to memory of 1628	1788	rundll32.exe	27
PID 1628 wrote to memory of 1560	1628	rundll32.exe	28
PID 1628 wrote to memory of 1560	1628	rundll32.exe	28
PID 1628 wrote to memory of 1560	1628	rundll32.exe	28
PID 1628 wrote to memory of 1560	1628	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\916-57-0x0000000000AD0000-0x0000000000AFA000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\916-57-0x0000000000AD0000-0x0000000000AFA000-memory.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 196
    3⤵
    - Program crash
    PID:1560

memory/1628-55-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download