d58f490a9a2e6ff540a77191b3dc771f5f5407040ed2c07db1ad945415f29d64

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
16-12-2022 02:17

Target

2012-57-0x0000000002040000-0x000000000206A000-memory.dll
Size

168KB
MD5

6d731532dc8e55de4c59a6584d8b2dd8
SHA1

72c1089f1ea58da01815fa87f2013862b944a947
SHA256

d58f490a9a2e6ff540a77191b3dc771f5f5407040ed2c07db1ad945415f29d64
SHA512

0e7cbccd1d5df16f3f074587b187886026a8c92685edd5b450fb82eddcaf1325d94f4fc46fec654e8bee8478d634cfe98a46fd17c36076a02e8f6367c76d1a02
SSDEEP

3072:4gi/4ZXJDpi80XfLzCANdOJ6benWTTBfJWJO/ya3cv:6w5N30PLzHGJtnWTTBBWg/

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1212 2032 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1212	2032	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2000 wrote to memory of 2032	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 2032	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 2032	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 2032	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 2032	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 2032	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 2032	2000	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 1212	2032	rundll32.exe	WerFault.exe
PID 2032 wrote to memory of 1212	2032	rundll32.exe	WerFault.exe
PID 2032 wrote to memory of 1212	2032	rundll32.exe	WerFault.exe
PID 2032 wrote to memory of 1212	2032	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2012-57-0x0000000002040000-0x000000000206A000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2012-57-0x0000000002040000-0x000000000206A000-memory.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 196
3⤵
- Program crash
PID:1212

memory/1212-56-0x0000000000000000-mapping.dmp

Download
memory/2032-54-0x0000000000000000-mapping.dmp

Download
memory/2032-55-0x00000000767B1000-0x00000000767B3000-memory.dmp

Filesize
8KB

Download