e152ce72b94c201d53534527fae31e427b183b7bdd331e4a022610032772538b

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
17-11-2022 23:39

Target

624-54-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

beb809833fc7e77b8879cbd2e299a86d
SHA1

c962d741335a7be83a3ceca551b8dad02d3202c1
SHA256

e152ce72b94c201d53534527fae31e427b183b7bdd331e4a022610032772538b
SHA512

0d286643a0fce3530048696d6a6dd8bf37c4a1a333a05441963c91044c643e4ad061d32ec3c82381f02d11417b98e3e37722d372bb36b785260c98c0b33c2e9d
SSDEEP

192:hHVMfa7TTCjJSixzPSAA56RCK7Yu/VPgwjyXBAQYfPq/3Kb:h1Mf0gJSix2AA56RCiZV6GQYnq/6b

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1516 624 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1516	624	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 624 wrote to memory of 1516	624	rundll32.exe	WerFault.exe
PID 624 wrote to memory of 1516	624	rundll32.exe	WerFault.exe
PID 624 wrote to memory of 1516	624	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\624-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:624

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 624 -s 56
2⤵
- Program crash
PID:1516