33dcd71f19c78e6f8912f191d7c797c735ef719c34847d70455094a9d75622a9

Analysis

max time kernel
39s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-11-2022 00:36

Target

1940-60-0x0000000000930000-0x000000000095A000-memory.dll
Size

168KB
MD5

5feed9285bfd8e165ff2e68ff0b109fc
SHA1

f9b232c4b0f7030cd810ed16e6d2e7a29045acfe
SHA256

33dcd71f19c78e6f8912f191d7c797c735ef719c34847d70455094a9d75622a9
SHA512

3a339604c237c2c4fd7a3776cd52cec2ae8f40899cce8917af601ed00fb93113bcd5b435c87036ae4062b532ee3b2aab33921b85ea0987d8c933ba8cc3d70c88
SSDEEP

3072:O4+3EYn4daxwQf2lCoWUiLAh4Jz99ksTBf1cva83c3O/ya:3Y4dA7+ZWUic+Jx9ksTBNn83ce/

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1968 1056 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1968	1056	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1088 wrote to memory of 1056	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1056	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1056	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1056	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1056	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1056	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1056	1088	rundll32.exe	rundll32.exe
PID 1056 wrote to memory of 1968	1056	rundll32.exe	WerFault.exe
PID 1056 wrote to memory of 1968	1056	rundll32.exe	WerFault.exe
PID 1056 wrote to memory of 1968	1056	rundll32.exe	WerFault.exe
PID 1056 wrote to memory of 1968	1056	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1940-60-0x0000000000930000-0x000000000095A000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1088

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1940-60-0x0000000000930000-0x000000000095A000-memory.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 196
3⤵
- Program crash
PID:1968

memory/1056-54-0x0000000000000000-mapping.dmp

Download
memory/1056-55-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/1968-56-0x0000000000000000-mapping.dmp

Download