18c77b7c94f93a5e5ae20c9ac22aa28d6706369800834fbf644e73c9892b3d89

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-11-2022 06:52

Target

1468-54-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

af15999ffa171ec9e41a0185d90f52d5
SHA1

e73d7c2f2dacd23cbba1b1d9317409fb1a834f03
SHA256

18c77b7c94f93a5e5ae20c9ac22aa28d6706369800834fbf644e73c9892b3d89
SHA512

e173027e0aa03aeba5c583e21138ee302dc22df5884c9d46211317153b47e2aaf64d2aeb8f9a2ca13c89d4744eb558cf888e43c795507a8910f4a8587bb2e411
SSDEEP

192:hHVMfa7TTCjJSixzPSAA56RCK7Yu/VPgwToXBAQYfPq/3Kb:h1Mf0gJSix2AA56RCiZVgGQYnq/6b

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1176 1336 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1176	1336	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1336 wrote to memory of 1176	1336	rundll32.exe	WerFault.exe
PID 1336 wrote to memory of 1176	1336	rundll32.exe	WerFault.exe
PID 1336 wrote to memory of 1176	1336	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1468-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1336

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1336 -s 56
2⤵
- Program crash
PID:1176