ce0acefe5b9586da40a6f913c4ae5f0abc7c2b8c18584bea76e8722d6dfb73f4

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18-11-2022 15:22

Target

1148-57-0x00000000001D0000-0x00000000001FA000-memory.dll
Size

168KB
MD5

2faec524cf5565d8257341326398bc08
SHA1

e5c8429b4966c9fb295fe379abe4ee225ffc319f
SHA256

ce0acefe5b9586da40a6f913c4ae5f0abc7c2b8c18584bea76e8722d6dfb73f4
SHA512

69d2c59ce6731edb6a052b5677d9ee667c58215afe2469ea4ba2ffac19b189e5276cb67143465ac077074f4e9d5f72af80a4d193f9627ff299bb8e6d7bc56322
SSDEEP

3072:m42R1+j+XyOz+A2C+Q1AmJNblpATBfpyva832CO/yaHk:xj2/ajC+QGmJRlpATBhR832d/s

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1636 1808 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1636	1808	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1096 wrote to memory of 1808	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 1808	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 1808	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 1808	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 1808	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 1808	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 1808	1096	rundll32.exe	rundll32.exe
PID 1808 wrote to memory of 1636	1808	rundll32.exe	WerFault.exe
PID 1808 wrote to memory of 1636	1808	rundll32.exe	WerFault.exe
PID 1808 wrote to memory of 1636	1808	rundll32.exe	WerFault.exe
PID 1808 wrote to memory of 1636	1808	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1148-57-0x00000000001D0000-0x00000000001FA000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1096

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1148-57-0x00000000001D0000-0x00000000001FA000-memory.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 196
3⤵
- Program crash
PID:1636

memory/1636-56-0x0000000000000000-mapping.dmp

Download
memory/1808-54-0x0000000000000000-mapping.dmp

Download
memory/1808-55-0x0000000075211000-0x0000000075213000-memory.dmp

Filesize
8KB

Download