b45a27a4dc4187431abec0b654ba82d7389c25e44df4ccd45fa32ab7ed611492

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
16-11-2022 23:42

Target

1640-54-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

246560e09e7dda1a26bbe0e70bb79f71
SHA1

acbf356a4255554fe8cf85432bdc31782bc90e05
SHA256

b45a27a4dc4187431abec0b654ba82d7389c25e44df4ccd45fa32ab7ed611492
SHA512

a991b8773cdffe8128cfa1615838a53139be18c51a8b0b7cd014a974a89b63bfb625f364af9d43f87023bde27e89133cf3aed4745ab5367bf315a4540979f539
SSDEEP

192:hHVMfa7TTCjJSixzPSAA56RCK7Yu/VPgwXXBAQYfPq/3Kb:h1Mf0gJSix2AA56RCiZVtGQYnq/6b

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1264 1232 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1264	1232	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1232 wrote to memory of 1264	1232	rundll32.exe	WerFault.exe
PID 1232 wrote to memory of 1264	1232	rundll32.exe	WerFault.exe
PID 1232 wrote to memory of 1264	1232	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1640-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1232

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1232 -s 56
2⤵
- Program crash
PID:1264