d5cc641f922ab7e2c68231c3d8696c450132e9a2874076fc0669bab1eac54de1

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
16-12-2022 02:14

Target

1756-56-0x00000000001C0000-0x00000000001EA000-memory.dll
Size

168KB
MD5

0feaeda6f0759e961596fd7cc32404e3
SHA1

3dd36130bd26d6170141383d5c2e017dbbf4f222
SHA256

d5cc641f922ab7e2c68231c3d8696c450132e9a2874076fc0669bab1eac54de1
SHA512

2ba469b3189aaabd3a64d37981e06e5af7fb98267af01f6f6e98aef6f662dbc75b36c833cf0aa19071a48d954ffd9070690bbaac89729ff60d818edde95b3ca3
SSDEEP

3072:CgquZd7BbtzKk2z7VqgMAWJ+UrIXTBf5qtO/ya1v:nd7R532/VqgJWJBrIXTBRq8/

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1312 1732 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1312	1732	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1436 wrote to memory of 1732	1436	rundll32.exe	rundll32.exe
PID 1436 wrote to memory of 1732	1436	rundll32.exe	rundll32.exe
PID 1436 wrote to memory of 1732	1436	rundll32.exe	rundll32.exe
PID 1436 wrote to memory of 1732	1436	rundll32.exe	rundll32.exe
PID 1436 wrote to memory of 1732	1436	rundll32.exe	rundll32.exe
PID 1436 wrote to memory of 1732	1436	rundll32.exe	rundll32.exe
PID 1436 wrote to memory of 1732	1436	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 1312	1732	rundll32.exe	WerFault.exe
PID 1732 wrote to memory of 1312	1732	rundll32.exe	WerFault.exe
PID 1732 wrote to memory of 1312	1732	rundll32.exe	WerFault.exe
PID 1732 wrote to memory of 1312	1732	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1756-56-0x00000000001C0000-0x00000000001EA000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1436

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1756-56-0x00000000001C0000-0x00000000001EA000-memory.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 196
3⤵
- Program crash
PID:1312

memory/1312-56-0x0000000000000000-mapping.dmp

Download
memory/1732-54-0x0000000000000000-mapping.dmp

Download
memory/1732-55-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download