0083c4e1703cfb4d776701eac4eb387d418e8db8febec74c19a0f1b29602b8ce

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21-11-2022 12:38

Target

1668-57-0x00000000001D0000-0x00000000001FA000-memory.dll
Size

168KB
MD5

482881d65a62dfd049351e08a3039fd0
SHA1

84daa55d8f07a7535786ebdb8fd3dc9a87334fa4
SHA256

0083c4e1703cfb4d776701eac4eb387d418e8db8febec74c19a0f1b29602b8ce
SHA512

23c2c2421ffe95ff581996165dd088d6b6ee2125b4a5b124420c0ff8ba2f387b2daa89db58c168de04c310452505bdcb1f822a98888d914fa539e5b58bbbd192
SSDEEP

3072:m42R1+j+XyOz+A2C+Q1AmJNbl/ATBfpyva832VO/ya:xj2/ajC+QGmJRl/ATBhR832E/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1948	1956	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 1956	1784	rundll32.exe	28
PID 1784 wrote to memory of 1956	1784	rundll32.exe	28
PID 1784 wrote to memory of 1956	1784	rundll32.exe	28
PID 1784 wrote to memory of 1956	1784	rundll32.exe	28
PID 1784 wrote to memory of 1956	1784	rundll32.exe	28
PID 1784 wrote to memory of 1956	1784	rundll32.exe	28
PID 1784 wrote to memory of 1956	1784	rundll32.exe	28
PID 1956 wrote to memory of 1948	1956	rundll32.exe	29
PID 1956 wrote to memory of 1948	1956	rundll32.exe	29
PID 1956 wrote to memory of 1948	1956	rundll32.exe	29
PID 1956 wrote to memory of 1948	1956	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x00000000001D0000-0x00000000001FA000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x00000000001D0000-0x00000000001FA000-memory.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 196
    3⤵
    - Program crash
    PID:1948

memory/1956-55-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download