e824bb212b6dd4c8b9a7e7454ef8dd6148d23af26e1fa81a7c0db6c4c3d13fcf

Analysis

max time kernel
6s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:48

Target

2000-58-0x0000000000210000-0x000000000028F000-memory.dll
Size

508KB
MD5

2a5bd7b2ad26272a636e387cdfe57a11
SHA1

e8687d7783ad3900d80618a4b229f62e14ddcb6c
SHA256

e824bb212b6dd4c8b9a7e7454ef8dd6148d23af26e1fa81a7c0db6c4c3d13fcf
SHA512

812c1cf31e7de5ba3b50b72750d7db1ee962af69c4fd3054ef647dfff0cb62dd68fab05800ceb052392cc0d03dc695a53cf79e59cfb8e9ff22a345ca25a099e5
SSDEEP

768:D2Z7fteeACqv3yOPstw7V/O3K3SMgq+c/:SrtejD8kVW2RE4

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1040 1420 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1040	1420	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 628 wrote to memory of 1420	628	rundll32.exe	rundll32.exe
PID 628 wrote to memory of 1420	628	rundll32.exe	rundll32.exe
PID 628 wrote to memory of 1420	628	rundll32.exe	rundll32.exe
PID 628 wrote to memory of 1420	628	rundll32.exe	rundll32.exe
PID 628 wrote to memory of 1420	628	rundll32.exe	rundll32.exe
PID 628 wrote to memory of 1420	628	rundll32.exe	rundll32.exe
PID 628 wrote to memory of 1420	628	rundll32.exe	rundll32.exe
PID 1420 wrote to memory of 1040	1420	rundll32.exe	WerFault.exe
PID 1420 wrote to memory of 1040	1420	rundll32.exe	WerFault.exe
PID 1420 wrote to memory of 1040	1420	rundll32.exe	WerFault.exe
PID 1420 wrote to memory of 1040	1420	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2000-58-0x0000000000210000-0x000000000028F000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:628

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2000-58-0x0000000000210000-0x000000000028F000-memory.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 196
3⤵
- Program crash
PID:1040

memory/1040-56-0x0000000000000000-mapping.dmp

Download
memory/1420-54-0x0000000000000000-mapping.dmp

Download
memory/1420-55-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download