0b6332d5c21ef5ce679012b3bdec9117c0416b6516eaa36fcec071e2679dc854

Analysis

max time kernel
38s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
16-11-2022 17:12

Target

1592-59-0x00000000001F0000-0x000000000021A000-memory.dll
Size

168KB
MD5

841caeb9df648c6f86147409eec5ca68
SHA1

c508dc3560f8a8d2b9231d3ddede9abea11a514f
SHA256

0b6332d5c21ef5ce679012b3bdec9117c0416b6516eaa36fcec071e2679dc854
SHA512

27b3014e938936b46078e59dfea5cfb3b7fc4f47807a4769bd1dc63f6376819032281bd81b9c5176c9b421e8d04d6b2f8dd9ca056ac7ff3d01288a8c27f7cf55
SSDEEP

3072:qwXPDBCTDRojCZKk2Ws4+onAgJJZtKLTBfdSgcyO/ya+aY:H0RAPWs4FAgJftKLTBVS/N/

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

844 2028 WerFault.exe rundll32.exe

pid	pid_target	process	target process
844	2028	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1780 wrote to memory of 2028	1780	rundll32.exe	rundll32.exe
PID 1780 wrote to memory of 2028	1780	rundll32.exe	rundll32.exe
PID 1780 wrote to memory of 2028	1780	rundll32.exe	rundll32.exe
PID 1780 wrote to memory of 2028	1780	rundll32.exe	rundll32.exe
PID 1780 wrote to memory of 2028	1780	rundll32.exe	rundll32.exe
PID 1780 wrote to memory of 2028	1780	rundll32.exe	rundll32.exe
PID 1780 wrote to memory of 2028	1780	rundll32.exe	rundll32.exe
PID 2028 wrote to memory of 844	2028	rundll32.exe	WerFault.exe
PID 2028 wrote to memory of 844	2028	rundll32.exe	WerFault.exe
PID 2028 wrote to memory of 844	2028	rundll32.exe	WerFault.exe
PID 2028 wrote to memory of 844	2028	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1592-59-0x00000000001F0000-0x000000000021A000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1592-59-0x00000000001F0000-0x000000000021A000-memory.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 196
    3⤵
    - Program crash
    PID:844

memory/844-56-0x0000000000000000-mapping.dmp

Download
memory/2028-54-0x0000000000000000-mapping.dmp

Download
memory/2028-55-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download