6004e7bce21903f5c8b064b0e6a7bd83a68e52740879e04b6863983267150777

Analysis

max time kernel
42s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 17:26

Target

1680-97-0x0000000000250000-0x000000000027A000-memory.dll
Size

168KB
MD5

95d73563c8429ab1201c3f5c475cf53a
SHA1

18c7a0ff06d14ed2799ba5d92254334f14edb2ae
SHA256

6004e7bce21903f5c8b064b0e6a7bd83a68e52740879e04b6863983267150777
SHA512

daea97845543ce04ddd60ecbb0d6a45f222d2e1c58406ac9e07f655b7b164e5b6465cf2c1d8e0afac55800fd644b91ab521dd1634b3943e6da33354dd230b8b7
SSDEEP

3072:ogSPueeAMUSf/vGctAcJTRFg3TBfpA5O/yaGv:pzdDfXGcucJVFg3TBhAQ/

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

976 1652 WerFault.exe rundll32.exe

pid	pid_target	process	target process
976	1652	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1084 wrote to memory of 1652	1084	rundll32.exe	rundll32.exe
PID 1084 wrote to memory of 1652	1084	rundll32.exe	rundll32.exe
PID 1084 wrote to memory of 1652	1084	rundll32.exe	rundll32.exe
PID 1084 wrote to memory of 1652	1084	rundll32.exe	rundll32.exe
PID 1084 wrote to memory of 1652	1084	rundll32.exe	rundll32.exe
PID 1084 wrote to memory of 1652	1084	rundll32.exe	rundll32.exe
PID 1084 wrote to memory of 1652	1084	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 976	1652	rundll32.exe	WerFault.exe
PID 1652 wrote to memory of 976	1652	rundll32.exe	WerFault.exe
PID 1652 wrote to memory of 976	1652	rundll32.exe	WerFault.exe
PID 1652 wrote to memory of 976	1652	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1680-97-0x0000000000250000-0x000000000027A000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1084

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1680-97-0x0000000000250000-0x000000000027A000-memory.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 196
3⤵
- Program crash
PID:976

memory/976-56-0x0000000000000000-mapping.dmp

Download
memory/1652-54-0x0000000000000000-mapping.dmp

Download
memory/1652-55-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download