f76c87d5922d5d393581402ac205bd17cad66e0b1a002a83830e96a7a13d15a7

Analysis

max time kernel
42s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14-12-2022 10:53

Target

1700-72-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

92a4b75427a3b64d75d8e0a5deb648b8
SHA1

3b8c0e9156dc7a8ccc40c5df71d6d87a47c2ed47
SHA256

f76c87d5922d5d393581402ac205bd17cad66e0b1a002a83830e96a7a13d15a7
SHA512

48a5e01081a8626ab3a8f7209fe6fff2e74d55e2b6f1b46cceb6d90a074666fa91a75276a0b5f8f9c09b444eb495443478d01bea3d21953994714bf88cf0c4cd
SSDEEP

192:6P+nM5KC/zxayGc3gzq7YjDaqzJCueT+RfbZne9s6PLQm+P0tkYGijY:s5Jxayczq7Yjt9lfle9s6PLZG6kYGi8

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1008 1076 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1008	1076	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1076 wrote to memory of 1008	1076	rundll32.exe	WerFault.exe
PID 1076 wrote to memory of 1008	1076	rundll32.exe	WerFault.exe
PID 1076 wrote to memory of 1008	1076	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1700-72-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1076

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1076 -s 56
2⤵
- Program crash
PID:1008