06c94c122956dcfc660722d0f65b94108af615d2d64630ceca058163b649a1f9

Analysis

max time kernel
38s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-11-2022 06:07

Target

1812-54-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

d93e225e76487547b83676f4e7cf1882
SHA1

bd0ba0932aa8015745837bf3b8e55fb45502ee81
SHA256

06c94c122956dcfc660722d0f65b94108af615d2d64630ceca058163b649a1f9
SHA512

de073c7fe30d6b60385d9d6854ecb0b48b8af76b79ef0132c311e6d198cdb49910f94e275efdda13635dfdb9f1fef88cb763401246e7d7b9e5b33c19cb41d498
SSDEEP

192:hHVMfa7TTCjJSixzPSAA56RCK7Yu/VPgwmUh4XBAQYfPq/3Kb:h1Mf0gJSix2AA56RCiZVj6GQYnq/6b

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1644 1672 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1644	1672	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1672 wrote to memory of 1644	1672	rundll32.exe	WerFault.exe
PID 1672 wrote to memory of 1644	1672	rundll32.exe	WerFault.exe
PID 1672 wrote to memory of 1644	1672	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1812-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1672 -s 56
2⤵
- Program crash
PID:1644