bc92e039a4a5a966566338c65fa8767f71539be5dc4dda7a84e267693aff26f5

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
18-11-2022 14:35

Target

872-58-0x0000000000170000-0x000000000019A000-memory.dll
Size

168KB
MD5

cf9d74b71a190efeff41b610389e91fb
SHA1

93486203bbf7b09b56cc328032788e26710f76c4
SHA256

bc92e039a4a5a966566338c65fa8767f71539be5dc4dda7a84e267693aff26f5
SHA512

7763bf2c0e4ef0d110465d9e3489fa128f4f76c0c0de5613785e8d98224e142ce7cd66fb8af43384a0363c48eacc92d3825b530490f4f98e3e36fab4f67b03c7
SSDEEP

3072:u4+rkxEnGHr/sfQwF5iFz9C98kP+EuDWQuvAmJXBdncTBfdQva83YKO/yaa:HxEnGHr/sfQw4z9ED29WQuYmJRdncTBe

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1896 2040 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1896	2040	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1756 wrote to memory of 2040	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 2040	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 2040	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 2040	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 2040	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 2040	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 2040	1756	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1896	2040	rundll32.exe	WerFault.exe
PID 2040 wrote to memory of 1896	2040	rundll32.exe	WerFault.exe
PID 2040 wrote to memory of 1896	2040	rundll32.exe	WerFault.exe
PID 2040 wrote to memory of 1896	2040	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\872-58-0x0000000000170000-0x000000000019A000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\872-58-0x0000000000170000-0x000000000019A000-memory.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 196
3⤵
- Program crash
PID:1896

memory/1896-56-0x0000000000000000-mapping.dmp

Download
memory/2040-54-0x0000000000000000-mapping.dmp

Download
memory/2040-55-0x0000000076691000-0x0000000076693000-memory.dmp

Filesize
8KB

Download