6d8faea04b73087cf7ad4d9f28b6122aeb7603be941cd9bedf430bb2f531950a

Analysis

max time kernel
46s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
12-11-2022 10:21

Target

1184-54-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

a024e5ef8e8c1f405913a6bdd1b25026
SHA1

79a2a7d21fe384fb4b4e563ef34089a8d7741b91
SHA256

6d8faea04b73087cf7ad4d9f28b6122aeb7603be941cd9bedf430bb2f531950a
SHA512

87d6e79c24a34315ddc0a01a6aabbd77d35b92875ecf68382021361f41bd709446d026a525efe6f0a667144b18a3dd411d5a72b46d4c8e1c788cb97787bd9cb6
SSDEEP

192:hHVMfa7TTCjJSixzPSAA56RCK7Yu/VPgwhHKU6HXBAQYfPq/3Kb:h1Mf0gJSix2AA56RCiZVDS3GQYnq/6b

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1516 1456 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1516	1456	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1456 wrote to memory of 1516	1456	rundll32.exe	WerFault.exe
PID 1456 wrote to memory of 1516	1456	rundll32.exe	WerFault.exe
PID 1456 wrote to memory of 1516	1456	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1184-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1456

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1456 -s 56
2⤵
- Program crash
PID:1516