1755cb9843babbdd301cf1310dd1a6219463d0176ed18d4ebefb1ce39355d6ae

Analysis

max time kernel
35s
max time network
39s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-11-2022 21:39

Target

828-57-0x0000000000220000-0x000000000024A000-memory.dll
Size

168KB
MD5

d7e78211f34d679a9cb1fa3a9a78f70c
SHA1

1221e0eae146012f69795d61031fd3db88713a7b
SHA256

1755cb9843babbdd301cf1310dd1a6219463d0176ed18d4ebefb1ce39355d6ae
SHA512

7aed2528e4c403461bf9dd725315b90ae6fcda33dbf0261d03da6d4584708eb86a4d3c042aefced4aae878d601b2450133ffb4d1b62ccf43a980d9ff66ba05eb
SSDEEP

3072:+/wK5QPwn1P0/Xbu9eAeJj7nVoTBf1igYBO/yaxX1:1Cq/Xbu9reJXnVoTBti/Y/

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1964 1260 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1964	1260	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1488 wrote to memory of 1260	1488	rundll32.exe	rundll32.exe
PID 1488 wrote to memory of 1260	1488	rundll32.exe	rundll32.exe
PID 1488 wrote to memory of 1260	1488	rundll32.exe	rundll32.exe
PID 1488 wrote to memory of 1260	1488	rundll32.exe	rundll32.exe
PID 1488 wrote to memory of 1260	1488	rundll32.exe	rundll32.exe
PID 1488 wrote to memory of 1260	1488	rundll32.exe	rundll32.exe
PID 1488 wrote to memory of 1260	1488	rundll32.exe	rundll32.exe
PID 1260 wrote to memory of 1964	1260	rundll32.exe	WerFault.exe
PID 1260 wrote to memory of 1964	1260	rundll32.exe	WerFault.exe
PID 1260 wrote to memory of 1964	1260	rundll32.exe	WerFault.exe
PID 1260 wrote to memory of 1964	1260	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\828-57-0x0000000000220000-0x000000000024A000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1488

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\828-57-0x0000000000220000-0x000000000024A000-memory.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 196
3⤵
- Program crash
PID:1964

memory/1260-54-0x0000000000000000-mapping.dmp

Download
memory/1260-55-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

Filesize
8KB

Download
memory/1964-56-0x0000000000000000-mapping.dmp

Download