a64db0f91f08e3a99bde93faf047fe878cb1e0869a67fcb545947ddd476acc9f

Analysis

max time kernel
12s
max time network
170s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
19-11-2022 23:10

Target

784-60-0x00000000001C0000-0x00000000001EA000-memory.dll
Size

168KB
MD5

eae3971ddfca2d747555554f2ed55703
SHA1

f34c871558e867d243edab7720ec1870226f5c43
SHA256

a64db0f91f08e3a99bde93faf047fe878cb1e0869a67fcb545947ddd476acc9f
SHA512

6e3b84493d770fb183f54d266175bd81b3122d0bf498cdef4f902c918f827048d45f50683bc95ffde13a55f4417d3d5cfed0029bf3ad1b40f0463d821b00d1f1
SSDEEP

3072:U4uOcRaqajLtA8bGVg+gAYJgGrRYTBf5Pva83JtO/yaa:WazvC6GVg+VYJxrRYTBR683J8/S

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1384 2008 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1384	2008	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1076 wrote to memory of 2008	1076	rundll32.exe	rundll32.exe
PID 1076 wrote to memory of 2008	1076	rundll32.exe	rundll32.exe
PID 1076 wrote to memory of 2008	1076	rundll32.exe	rundll32.exe
PID 1076 wrote to memory of 2008	1076	rundll32.exe	rundll32.exe
PID 1076 wrote to memory of 2008	1076	rundll32.exe	rundll32.exe
PID 1076 wrote to memory of 2008	1076	rundll32.exe	rundll32.exe
PID 1076 wrote to memory of 2008	1076	rundll32.exe	rundll32.exe
PID 2008 wrote to memory of 1384	2008	rundll32.exe	WerFault.exe
PID 2008 wrote to memory of 1384	2008	rundll32.exe	WerFault.exe
PID 2008 wrote to memory of 1384	2008	rundll32.exe	WerFault.exe
PID 2008 wrote to memory of 1384	2008	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\784-60-0x00000000001C0000-0x00000000001EA000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\784-60-0x00000000001C0000-0x00000000001EA000-memory.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 196
    3⤵
    - Program crash
    PID:1384

memory/1384-56-0x0000000000000000-mapping.dmp

Download
memory/2008-54-0x0000000000000000-mapping.dmp

Download
memory/2008-55-0x0000000076AE1000-0x0000000076AE3000-memory.dmp

Filesize
8KB

Download