1755cb9843babbdd301cf1310dd1a6219463d0176ed18d4ebefb1ce39355d6ae

Analysis

max time kernel
62s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2022 21:39

Target

828-57-0x0000000000220000-0x000000000024A000-memory.dll
Size

168KB
MD5

d7e78211f34d679a9cb1fa3a9a78f70c
SHA1

1221e0eae146012f69795d61031fd3db88713a7b
SHA256

1755cb9843babbdd301cf1310dd1a6219463d0176ed18d4ebefb1ce39355d6ae
SHA512

7aed2528e4c403461bf9dd725315b90ae6fcda33dbf0261d03da6d4584708eb86a4d3c042aefced4aae878d601b2450133ffb4d1b62ccf43a980d9ff66ba05eb
SSDEEP

3072:+/wK5QPwn1P0/Xbu9eAeJj7nVoTBf1igYBO/yaxX1:1Cq/Xbu9reJXnVoTBti/Y/

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1936 1940 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1936	1940	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1312 wrote to memory of 1940	1312	rundll32.exe	rundll32.exe
PID 1312 wrote to memory of 1940	1312	rundll32.exe	rundll32.exe
PID 1312 wrote to memory of 1940	1312	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\828-57-0x0000000000220000-0x000000000024A000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1312

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\828-57-0x0000000000220000-0x000000000024A000-memory.dll,#1
2⤵
PID:1940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 560
3⤵
- Program crash
PID:1936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1940 -ip 1940
1⤵
PID:3600