62f451ccf95c0104dbb49773e665aa12ea166395b786b354f37b617822aecc7c

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12-11-2022 10:16

Target

1552-54-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

d2e9b0f67d662cffe3802d335262b693
SHA1

5c9c0c8594252ba83f3c2b276847244a7a383b71
SHA256

62f451ccf95c0104dbb49773e665aa12ea166395b786b354f37b617822aecc7c
SHA512

29212b950c08391704da111d5009474136da1b72f926611a39956ecf60e8f6545287c5ead50b7b646cacb838f86b85ed27027a3968ebff3a24c640c405def71e
SSDEEP

384:h1Mf0gJSix2AA56RCiZVH3yYGQYnq/6b:zZeS6AIoiHXLCqi

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1168 1884 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1168	1884	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1884 wrote to memory of 1168	1884	rundll32.exe	WerFault.exe
PID 1884 wrote to memory of 1168	1884	rundll32.exe	WerFault.exe
PID 1884 wrote to memory of 1168	1884	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1552-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1884

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1884 -s 56
2⤵
- Program crash
PID:1168