c86dd42f564dd64505d70fbf852bd5069d4dcf092fea145a125d49c219b4fb78

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18-11-2022 15:52

Target

1944-58-0x0000000000230000-0x000000000025A000-memory.dll
Size

168KB
MD5

3fc455fca17b55ccf7d5f38fdf1dc76f
SHA1

a78c3ce5c50f9925dda76170b18d99a6d4350c83
SHA256

c86dd42f564dd64505d70fbf852bd5069d4dcf092fea145a125d49c219b4fb78
SHA512

152464c4715572790303eccee2359e61854f36c8f12f0b82e10d0cdeb53f1f9c7580b04b30e20f7349abf363e6534f1dac79c32515d9f87cdcbfe1f7be433b6c
SSDEEP

3072:e4+nqaIS0aBTcgfWcY2ESbA+JDeedzMTBf1Mva83MeO/ya:fS0QTX+J2ESM+JxdzMTBt383MB/

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1920 780 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1920	780	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 900 wrote to memory of 780	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 780	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 780	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 780	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 780	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 780	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 780	900	rundll32.exe	rundll32.exe
PID 780 wrote to memory of 1920	780	rundll32.exe	WerFault.exe
PID 780 wrote to memory of 1920	780	rundll32.exe	WerFault.exe
PID 780 wrote to memory of 1920	780	rundll32.exe	WerFault.exe
PID 780 wrote to memory of 1920	780	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1944-58-0x0000000000230000-0x000000000025A000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1944-58-0x0000000000230000-0x000000000025A000-memory.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 196
    3⤵
    - Program crash
    PID:1920

memory/780-54-0x0000000000000000-mapping.dmp

Download
memory/780-55-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/1920-56-0x0000000000000000-mapping.dmp

Download