c886b998a42fed1b1e147be9791507c29317676f4a69a35e6e3a3207b3567e2f

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 17:39

Target

1672-97-0x0000000000200000-0x000000000022A000-memory.dll
Size

168KB
MD5

0164b20f2cb331f01f3ecd5dca29d31e
SHA1

693ac72f18ec24e6d3d8d772f851442ac6d25f7e
SHA256

c886b998a42fed1b1e147be9791507c29317676f4a69a35e6e3a3207b3567e2f
SHA512

68a22d4eb4965cdaec4b01f21981f01f2f75078965b9986a050acedf03578e7a097675d07308fb24297891d214194f575522c759f5b3e962d734a3b59ae816ed
SSDEEP

3072:SgiSH5HRFVScyzTBxwAWJKwTxnTBfZykO/yaGv:FdrVXyXBxFWJpTxnTBxyP/

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1720 1752 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1720	1752	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1052 wrote to memory of 1752	1052	rundll32.exe	rundll32.exe
PID 1052 wrote to memory of 1752	1052	rundll32.exe	rundll32.exe
PID 1052 wrote to memory of 1752	1052	rundll32.exe	rundll32.exe
PID 1052 wrote to memory of 1752	1052	rundll32.exe	rundll32.exe
PID 1052 wrote to memory of 1752	1052	rundll32.exe	rundll32.exe
PID 1052 wrote to memory of 1752	1052	rundll32.exe	rundll32.exe
PID 1052 wrote to memory of 1752	1052	rundll32.exe	rundll32.exe
PID 1752 wrote to memory of 1720	1752	rundll32.exe	WerFault.exe
PID 1752 wrote to memory of 1720	1752	rundll32.exe	WerFault.exe
PID 1752 wrote to memory of 1720	1752	rundll32.exe	WerFault.exe
PID 1752 wrote to memory of 1720	1752	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1672-97-0x0000000000200000-0x000000000022A000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1052

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1672-97-0x0000000000200000-0x000000000022A000-memory.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 196
3⤵
- Program crash
PID:1720

memory/1720-56-0x0000000000000000-mapping.dmp

Download
memory/1752-54-0x0000000000000000-mapping.dmp

Download
memory/1752-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download