0b15254ebd4356ad6a42642371f7c86c5ac64f655aca14e24ca5d3346e3ffa75

Analysis

max time kernel
57s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
21-11-2022 14:17

Target

1368-57-0x0000000000140000-0x000000000016A000-memory.dll
Size

168KB
MD5

e4096cb8b1cde9f6c38bddfd1ac9e458
SHA1

6f76d3bf5b50ed7f6ecea0ecb0fbc97814305389
SHA256

0b15254ebd4356ad6a42642371f7c86c5ac64f655aca14e24ca5d3346e3ffa75
SHA512

8d362d98260e298ed1e6056f94f49fb945fddf32a32dadc09ece40b68e52a65a2b92021bec0f492b13d716c1d5d0fe08dc039fa51726932a299406885c65f693
SSDEEP

3072:U4em8H5CayLb3NAcjWN1oA4JYQxzr8oTBfZXva83R3O/ya:OCr/yiWN1t4JRr8oTBxi83Re/

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1352 1948 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1352	1948	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 964 wrote to memory of 1948	964	rundll32.exe	rundll32.exe
PID 964 wrote to memory of 1948	964	rundll32.exe	rundll32.exe
PID 964 wrote to memory of 1948	964	rundll32.exe	rundll32.exe
PID 964 wrote to memory of 1948	964	rundll32.exe	rundll32.exe
PID 964 wrote to memory of 1948	964	rundll32.exe	rundll32.exe
PID 964 wrote to memory of 1948	964	rundll32.exe	rundll32.exe
PID 964 wrote to memory of 1948	964	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 1352	1948	rundll32.exe	WerFault.exe
PID 1948 wrote to memory of 1352	1948	rundll32.exe	WerFault.exe
PID 1948 wrote to memory of 1352	1948	rundll32.exe	WerFault.exe
PID 1948 wrote to memory of 1352	1948	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1368-57-0x0000000000140000-0x000000000016A000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1368-57-0x0000000000140000-0x000000000016A000-memory.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 196
    3⤵
    - Program crash
    PID:1352

memory/1352-56-0x0000000000000000-mapping.dmp

Download
memory/1948-54-0x0000000000000000-mapping.dmp

Download
memory/1948-55-0x0000000075D51000-0x0000000075D53000-memory.dmp

Filesize
8KB

Download