9fa7c9dcb1f1cf71f2d698c0ad4c4492075fc2daa447023807079e2d806283f5

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
17-11-2022 19:14

Target

2028-59-0x00000000003F0000-0x000000000041A000-memory.dll
Size

168KB
MD5

3c7fb2345971ac4c52247311bab73fae
SHA1

df07a0196c0aad5c01b0a9d6994f99d0f45d4bd1
SHA256

9fa7c9dcb1f1cf71f2d698c0ad4c4492075fc2daa447023807079e2d806283f5
SHA512

2bcd482b14486103ff9d169c3217a698129d80793d312143c0c988805776f85482a9c94367ff0ebf3f51a951cfb3de96fc76d129c96934b65814b8031871c37d
SSDEEP

3072:O4+DQwEFLilE8/+E8WYyNHAmJvZtbMTBfdova83gBO/ya3:rFLMjGlWYmgmJBtbMTBVD83gY/v

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2012 1680 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2012	1680	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 824 wrote to memory of 1680	824	rundll32.exe	rundll32.exe
PID 824 wrote to memory of 1680	824	rundll32.exe	rundll32.exe
PID 824 wrote to memory of 1680	824	rundll32.exe	rundll32.exe
PID 824 wrote to memory of 1680	824	rundll32.exe	rundll32.exe
PID 824 wrote to memory of 1680	824	rundll32.exe	rundll32.exe
PID 824 wrote to memory of 1680	824	rundll32.exe	rundll32.exe
PID 824 wrote to memory of 1680	824	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 2012	1680	rundll32.exe	WerFault.exe
PID 1680 wrote to memory of 2012	1680	rundll32.exe	WerFault.exe
PID 1680 wrote to memory of 2012	1680	rundll32.exe	WerFault.exe
PID 1680 wrote to memory of 2012	1680	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2028-59-0x00000000003F0000-0x000000000041A000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2028-59-0x00000000003F0000-0x000000000041A000-memory.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 196
    3⤵
    - Program crash
    PID:2012

memory/1680-54-0x0000000000000000-mapping.dmp

Download
memory/1680-55-0x00000000765A1000-0x00000000765A3000-memory.dmp

Filesize
8KB

Download
memory/2012-56-0x0000000000000000-mapping.dmp

Download