20d4b052685c6a92cb94dbceafc8ed5a7f3adf84ca6b76f27ebb6032cc8bb0a6

Analysis

max time kernel
29s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
22-11-2022 12:55

Target

748-57-0x0000000000390000-0x00000000003BA000-memory.dll
Size

168KB
MD5

ddca563f218d63573bda7bb77cf3ead9
SHA1

e497a2b7bcfc42d3943e18ea50e02711981e5ea8
SHA256

20d4b052685c6a92cb94dbceafc8ed5a7f3adf84ca6b76f27ebb6032cc8bb0a6
SHA512

09dc7ce9db096985c65cf158e0eaa5f30b90dc91df662143dcfd255fbd6e3df437c556431f987972bed6078cc1389600bc35401937b0d3fb08d25bcac4cf613e
SSDEEP

3072:ywh1VjQ9AwZ1OswizhAQJPX1lnTBfJ8g+CO/ya+aY:7ehuswizKQJv1lnTBB8Zd/

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1736 928 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1736	928	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2032 wrote to memory of 928	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 928	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 928	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 928	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 928	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 928	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 928	2032	rundll32.exe	rundll32.exe
PID 928 wrote to memory of 1736	928	rundll32.exe	WerFault.exe
PID 928 wrote to memory of 1736	928	rundll32.exe	WerFault.exe
PID 928 wrote to memory of 1736	928	rundll32.exe	WerFault.exe
PID 928 wrote to memory of 1736	928	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\748-57-0x0000000000390000-0x00000000003BA000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\748-57-0x0000000000390000-0x00000000003BA000-memory.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 196
    3⤵
    - Program crash
    PID:1736

memory/928-54-0x0000000000000000-mapping.dmp

Download
memory/928-55-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/1736-56-0x0000000000000000-mapping.dmp

Download