4e5bdb084b62676d9f1e12e0e5587ef600b59332ede49dbd063843f7633b7a70

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-11-2022 06:47

Target

548-54-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

c70d59c72a9b01fd7eed6aec907f2786
SHA1

b8e2333831c6007c7eae98bf7062a26fc5a1e0ca
SHA256

4e5bdb084b62676d9f1e12e0e5587ef600b59332ede49dbd063843f7633b7a70
SHA512

76e04cef0325b91baf45b35cfea3bd6dd87ec1ed4f822095688fcd27c7235393f418f3f604c9978c7a43d77e94b70cfa26b89b068f9a165adde51a0cae7710ba
SSDEEP

384:h1Mf0gJSix2AA56RCiZV6ucpGQYnq/6b:zZeS6AIoiH4pCqi

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1832 1100 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1832	1100	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1100 wrote to memory of 1832	1100	rundll32.exe	WerFault.exe
PID 1100 wrote to memory of 1832	1100	rundll32.exe	WerFault.exe
PID 1100 wrote to memory of 1832	1100	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\548-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1100

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1100 -s 56
2⤵
- Program crash
PID:1832