ac787fded0c32b4c2fdd93648e6e8c5619f1b1b705866ba8ae520bc032a679ad

Analysis

max time kernel
58s
max time network
29s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
09-12-2022 10:18

Target

436-97-0x0000000000190000-0x00000000001BA000-memory.dll
Size

168KB
MD5

40e240b717c74a96abaf171f100543aa
SHA1

bc55fb0f68ca46ccbd8ba08161b6bd8fc2855756
SHA256

ac787fded0c32b4c2fdd93648e6e8c5619f1b1b705866ba8ae520bc032a679ad
SHA512

d074847ed0b796869dec4d7c7d7b960a7bbf8a220b3d4c64008d42ddcf21f0b79fb4b03159510bfaff74d8e3209db9b7a3608fc45055b3a04c3e7737cc1b21c5
SSDEEP

3072:ogKraqmkKEgc60s3HC6zBAkJfF1znTBfJAHO/yaoICv:BvkK1LLXCIqkJ91znTBBAu/g

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

336 1216 WerFault.exe rundll32.exe

pid	pid_target	process	target process
336	1216	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 980 wrote to memory of 1216	980	rundll32.exe	rundll32.exe
PID 980 wrote to memory of 1216	980	rundll32.exe	rundll32.exe
PID 980 wrote to memory of 1216	980	rundll32.exe	rundll32.exe
PID 980 wrote to memory of 1216	980	rundll32.exe	rundll32.exe
PID 980 wrote to memory of 1216	980	rundll32.exe	rundll32.exe
PID 980 wrote to memory of 1216	980	rundll32.exe	rundll32.exe
PID 980 wrote to memory of 1216	980	rundll32.exe	rundll32.exe
PID 1216 wrote to memory of 336	1216	rundll32.exe	WerFault.exe
PID 1216 wrote to memory of 336	1216	rundll32.exe	WerFault.exe
PID 1216 wrote to memory of 336	1216	rundll32.exe	WerFault.exe
PID 1216 wrote to memory of 336	1216	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\436-97-0x0000000000190000-0x00000000001BA000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:980

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\436-97-0x0000000000190000-0x00000000001BA000-memory.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 196
3⤵
- Program crash
PID:336

memory/336-56-0x0000000000000000-mapping.dmp

Download
memory/1216-54-0x0000000000000000-mapping.dmp

Download
memory/1216-55-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download