1014b41fe4f40af29b5f9ef195ab9b5a1ff4ac9a8bfe693a75930cb78443d51b

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
18-11-2022 13:26

Target

608-58-0x00000000002F0000-0x000000000031A000-memory.dll
Size

168KB
MD5

de6a538e416174d1224990910fb7c7da
SHA1

c88864d1a28eb3117817212bd6222fa81b3b3bb7
SHA256

1014b41fe4f40af29b5f9ef195ab9b5a1ff4ac9a8bfe693a75930cb78443d51b
SHA512

f58e082bbf0400d107ab78ca99c1a9e5e4cc191661b437e1661f744b91032c9bbd3746235aa16f7597736e065264a7df22f17a410bb2382c57f8a675155da172
SSDEEP

3072:+4+TH0hC1UsfeEPEWouv3AGJfJNKsTBfd4va83Q2O/yaa:rh8jGKEWoWwGJhNKsTBVz83Q5/S

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1756 1264 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1756	1264	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1232 wrote to memory of 1264	1232	rundll32.exe	rundll32.exe
PID 1232 wrote to memory of 1264	1232	rundll32.exe	rundll32.exe
PID 1232 wrote to memory of 1264	1232	rundll32.exe	rundll32.exe
PID 1232 wrote to memory of 1264	1232	rundll32.exe	rundll32.exe
PID 1232 wrote to memory of 1264	1232	rundll32.exe	rundll32.exe
PID 1232 wrote to memory of 1264	1232	rundll32.exe	rundll32.exe
PID 1232 wrote to memory of 1264	1232	rundll32.exe	rundll32.exe
PID 1264 wrote to memory of 1756	1264	rundll32.exe	WerFault.exe
PID 1264 wrote to memory of 1756	1264	rundll32.exe	WerFault.exe
PID 1264 wrote to memory of 1756	1264	rundll32.exe	WerFault.exe
PID 1264 wrote to memory of 1756	1264	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\608-58-0x00000000002F0000-0x000000000031A000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1232

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\608-58-0x00000000002F0000-0x000000000031A000-memory.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 196
3⤵
- Program crash
PID:1756

memory/1264-54-0x0000000000000000-mapping.dmp

Download
memory/1264-55-0x0000000075291000-0x0000000075293000-memory.dmp

Filesize
8KB

Download
memory/1756-56-0x0000000000000000-mapping.dmp

Download