594e79157e24f92ba2e362a39249cb0b2523b4c480a378c16fa3208de150e52f

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
20-11-2022 03:10

Target

1064-59-0x0000000000290000-0x00000000002BA000-memory.dll
Size

168KB
MD5

e1460b2fc0087fba735dfc0401fb815a
SHA1

173b0b7ecd72d0ee12af424edfc59adab07d308a
SHA256

594e79157e24f92ba2e362a39249cb0b2523b4c480a378c16fa3208de150e52f
SHA512

0d00beb167b32b8fdd7bd9bb121d28aa5e6ac4502ba2bca930b9ee22232bbbefc97d7d341db7d503d246a55ebbcee9cf2a20a8b3aa57a5349bea7d846ce4ead1
SSDEEP

3072:m4WN6C6wcu4nCDiabGQN06y0RA+JJnVwITBfJeva8318yO/ya:Nni/qk06y0a+JBVwITBBN8318N/

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

888 936 WerFault.exe rundll32.exe

pid	pid_target	process	target process
888	936	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1872 wrote to memory of 936	1872	rundll32.exe	rundll32.exe
PID 1872 wrote to memory of 936	1872	rundll32.exe	rundll32.exe
PID 1872 wrote to memory of 936	1872	rundll32.exe	rundll32.exe
PID 1872 wrote to memory of 936	1872	rundll32.exe	rundll32.exe
PID 1872 wrote to memory of 936	1872	rundll32.exe	rundll32.exe
PID 1872 wrote to memory of 936	1872	rundll32.exe	rundll32.exe
PID 1872 wrote to memory of 936	1872	rundll32.exe	rundll32.exe
PID 936 wrote to memory of 888	936	rundll32.exe	WerFault.exe
PID 936 wrote to memory of 888	936	rundll32.exe	WerFault.exe
PID 936 wrote to memory of 888	936	rundll32.exe	WerFault.exe
PID 936 wrote to memory of 888	936	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1064-59-0x0000000000290000-0x00000000002BA000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1064-59-0x0000000000290000-0x00000000002BA000-memory.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 196
    3⤵
    - Program crash
    PID:888

memory/888-56-0x0000000000000000-mapping.dmp

Download
memory/936-54-0x0000000000000000-mapping.dmp

Download
memory/936-55-0x0000000075EC1000-0x0000000075EC3000-memory.dmp

Filesize
8KB

Download