dd73e3fcfba58ee5e6c233173593541135647d2ae346d5351f11f12172102cd3

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-11-2022 21:30

Target

884-58-0x00000000001F0000-0x000000000021A000-memory.dll
Size

168KB
MD5

be4bb6b807a9720722ec36a41c31b66c
SHA1

ee0afbbcd145c0c9969a2d29644f7af176ddb9da
SHA256

dd73e3fcfba58ee5e6c233173593541135647d2ae346d5351f11f12172102cd3
SHA512

39d7a409fe2ad31fa758631ab379bdf2d2ef6b5868a7a896a1a9b871fdefabb40904b681aae3f83d9a2d22cdedc9d5642e9acc82efbee594fb0f03d81298c04e
SSDEEP

3072:s/VpdEmPMtlysJX4LvA4Jm6t5UTBfdFg0UO/yaxX1:sz0SsJX4LY4JDt5UTBVFL//

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1480 1568 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1480	1568	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 968 wrote to memory of 1568	968	rundll32.exe	rundll32.exe
PID 968 wrote to memory of 1568	968	rundll32.exe	rundll32.exe
PID 968 wrote to memory of 1568	968	rundll32.exe	rundll32.exe
PID 968 wrote to memory of 1568	968	rundll32.exe	rundll32.exe
PID 968 wrote to memory of 1568	968	rundll32.exe	rundll32.exe
PID 968 wrote to memory of 1568	968	rundll32.exe	rundll32.exe
PID 968 wrote to memory of 1568	968	rundll32.exe	rundll32.exe
PID 1568 wrote to memory of 1480	1568	rundll32.exe	WerFault.exe
PID 1568 wrote to memory of 1480	1568	rundll32.exe	WerFault.exe
PID 1568 wrote to memory of 1480	1568	rundll32.exe	WerFault.exe
PID 1568 wrote to memory of 1480	1568	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\884-58-0x00000000001F0000-0x000000000021A000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:968

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\884-58-0x00000000001F0000-0x000000000021A000-memory.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 196
3⤵
- Program crash
PID:1480

memory/1480-56-0x0000000000000000-mapping.dmp

Download
memory/1568-54-0x0000000000000000-mapping.dmp

Download
memory/1568-55-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download