50b141a77a6d7aee8bd9fe7f57aae3c22686b6ce30a43c524e95f304720fd8a2

Analysis

max time kernel
39s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
08-12-2022 11:43

Target

1252-95-0x0000000000490000-0x00000000004BA000-memory.dll
Size

168KB
MD5

75fda09c4e480fc88aef6d3d1a7f0139
SHA1

b67c0affdbcf75426eb05ced272cfc28706aba16
SHA256

50b141a77a6d7aee8bd9fe7f57aae3c22686b6ce30a43c524e95f304720fd8a2
SHA512

b73cd262f3d3b21eb1075046ed1c7892540daa5549ec2865f962d0a5ac5d4cc805b28b6cb0c5a2e2a8de65b329b44a67b1dcbfb09b89454202c0a19b08bc534d
SSDEEP

3072:ogqbq660Q8ab2YnS4xAd2JP1VJHTBfJghO/yapv:BT1LbXS46d2JdVJHTBBg4/

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

268 680 WerFault.exe rundll32.exe

pid	pid_target	process	target process
268	680	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 992 wrote to memory of 680	992	rundll32.exe	rundll32.exe
PID 992 wrote to memory of 680	992	rundll32.exe	rundll32.exe
PID 992 wrote to memory of 680	992	rundll32.exe	rundll32.exe
PID 992 wrote to memory of 680	992	rundll32.exe	rundll32.exe
PID 992 wrote to memory of 680	992	rundll32.exe	rundll32.exe
PID 992 wrote to memory of 680	992	rundll32.exe	rundll32.exe
PID 992 wrote to memory of 680	992	rundll32.exe	rundll32.exe
PID 680 wrote to memory of 268	680	rundll32.exe	WerFault.exe
PID 680 wrote to memory of 268	680	rundll32.exe	WerFault.exe
PID 680 wrote to memory of 268	680	rundll32.exe	WerFault.exe
PID 680 wrote to memory of 268	680	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1252-95-0x0000000000490000-0x00000000004BA000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:992

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1252-95-0x0000000000490000-0x00000000004BA000-memory.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 680 -s 196
3⤵
- Program crash
PID:268

memory/268-56-0x0000000000000000-mapping.dmp

Download
memory/680-54-0x0000000000000000-mapping.dmp

Download
memory/680-55-0x00000000767D1000-0x00000000767D3000-memory.dmp

Filesize
8KB

Download