783570885b85850e0872d1e5a88b4ca785b6dfc9c69c6289670afca759ccbbad

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12-11-2022 09:14

Target

1508-54-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

f6fa1d7374ab0a852197d1082552385a
SHA1

09a773e545e72b4cb21bb1ca0a29ae3af5a7b1fc
SHA256

783570885b85850e0872d1e5a88b4ca785b6dfc9c69c6289670afca759ccbbad
SHA512

4a8a331f267d699b008068a72a6d07551f4fc9f6883adaae6efbf36a96e7431f4d9d743bc975eb1a4159974b0a00c13a41041cc2cf882dd43033f4aa321c6729
SSDEEP

192:hHVMfa7TTCjJSixzPSAA56RCK7Yu/VPgw5AgXBAQYfPq/3KbH:h1Mf0gJSix2AA56RCiZVPdGQYnq/6b

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

964 1184 WerFault.exe rundll32.exe

pid	pid_target	process	target process
964	1184	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1184 wrote to memory of 964	1184	rundll32.exe	WerFault.exe
PID 1184 wrote to memory of 964	1184	rundll32.exe	WerFault.exe
PID 1184 wrote to memory of 964	1184	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1508-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1184

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1184 -s 56
2⤵
- Program crash
PID:964