0737443332ecacd2b242ed931a98cdfff9376cfff34170b31135883daf037a9d

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
17-11-2022 06:31

Target

656-54-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

56fe1d85b51d2154e2b2098cc0f75c80
SHA1

b13d7da809aac3038aefe2ea45493dfa390ac34b
SHA256

0737443332ecacd2b242ed931a98cdfff9376cfff34170b31135883daf037a9d
SHA512

c083e61b1604ba1f6e4eefb1abfe73b966f3cf489676ff13c6499a13baf596cbc2edc15bafd4d0f2c941a95fc8ba1dd5e7575fa58ef29a06aed9099982ba41cf
SSDEEP

192:hHVMfa7TTCjJSixzPSAA56RCK7Yu/VPgwjKMxXBAQYfPq/3Kbx+:h1Mf0gJSix2AA56RCiZVVVGQYnq/6bx

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1952 896 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1952	896	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 896 wrote to memory of 1952	896	rundll32.exe	WerFault.exe
PID 896 wrote to memory of 1952	896	rundll32.exe	WerFault.exe
PID 896 wrote to memory of 1952	896	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\656-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:896

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 896 -s 56
2⤵
- Program crash
PID:1952