0b8ff3c6e87fd060057f07eef9a1a91ae6f042ee18ee86ab8c7ba14d61feced7

Analysis

max time kernel
39s
max time network
29s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
08-12-2022 04:39

Target

1760-96-0x0000000000280000-0x00000000002AA000-memory.dll
Size

168KB
MD5

071ee7299d174fcedf7b549c53e16910
SHA1

afa01ae8005c0ad5f30ac4855841e5e227696a5a
SHA256

0b8ff3c6e87fd060057f07eef9a1a91ae6f042ee18ee86ab8c7ba14d61feced7
SHA512

ad5f32f31e14e146cd79de23ad833ee08a811498d73d90b51a21486ab3caa73e27202735037bc70de0ab73e524556d2451fbeeadc1d808de9e9bb65eca17ecde
SSDEEP

3072:SgSLOfBP5nXy8ajjp54AmJCIDH3TBf5CgO/ya3v:28tVX3aHp5dmJpDH3TBRCD/

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1712 2036 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1712	2036	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1052 wrote to memory of 2036	1052	rundll32.exe	rundll32.exe
PID 1052 wrote to memory of 2036	1052	rundll32.exe	rundll32.exe
PID 1052 wrote to memory of 2036	1052	rundll32.exe	rundll32.exe
PID 1052 wrote to memory of 2036	1052	rundll32.exe	rundll32.exe
PID 1052 wrote to memory of 2036	1052	rundll32.exe	rundll32.exe
PID 1052 wrote to memory of 2036	1052	rundll32.exe	rundll32.exe
PID 1052 wrote to memory of 2036	1052	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1712	2036	rundll32.exe	WerFault.exe
PID 2036 wrote to memory of 1712	2036	rundll32.exe	WerFault.exe
PID 2036 wrote to memory of 1712	2036	rundll32.exe	WerFault.exe
PID 2036 wrote to memory of 1712	2036	rundll32.exe	WerFault.exe

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1760-96-0x0000000000280000-0x00000000002AA000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 196
2⤵
- Program crash
PID:1712

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1760-96-0x0000000000280000-0x00000000002AA000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1052

memory/1712-56-0x0000000000000000-mapping.dmp

Download
memory/2036-54-0x0000000000000000-mapping.dmp

Download
memory/2036-55-0x0000000075291000-0x0000000075293000-memory.dmp

Filesize
8KB

Download