a56d4f940150b8a1db039fec7b17c66680a97a4e64e495a204603c165f1410ec

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15-11-2022 00:40

Target

1812-54-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

88b971d92380623f47242eb4127fd572
SHA1

0ed8becd939df1a1c12fcf58db8b66f32e3d9be7
SHA256

a56d4f940150b8a1db039fec7b17c66680a97a4e64e495a204603c165f1410ec
SHA512

397ccab9bef45101a0b60d75c3ff5b1961f6763c4c278f30b1264c85f71dd850b4724a4f79c5b6a6aeca0de69ba090970cd09db56b32b1e5772188483173312a
SSDEEP

192:hHVMfa7TTCjJSixzPSAA56RCK7Yu/VPgwOSXBAQYfPq/3KbA:h1Mf0gJSix2AA56RCiZVg4GQYnq/6bA

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

992 240 WerFault.exe rundll32.exe

pid	pid_target	process	target process
992	240	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 240 wrote to memory of 992	240	rundll32.exe	WerFault.exe
PID 240 wrote to memory of 992	240	rundll32.exe	WerFault.exe
PID 240 wrote to memory of 992	240	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1812-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:240

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 240 -s 56
2⤵
- Program crash
PID:992