ac8ab1f5f43ae1e26abd74c7362c09a0677b41bb89f2623c22a9b1190751fdf9

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
16/12/2022, 05:31

Target

1532-57-0x0000000000200000-0x000000000022A000-memory.dll
Size

168KB
MD5

1a05592e045af77cbd4a6fa0c0988ff1
SHA1

a0266ecfe34f963de0f0ea3a59a855bd5cbaa30d
SHA256

ac8ab1f5f43ae1e26abd74c7362c09a0677b41bb89f2623c22a9b1190751fdf9
SHA512

0cfeb68b8c691badf9f9613a119e329afe4173b37a8115065d4c815cfe803ea87e0923f18ae6bdf3c17a7012969e94b33068f31167bb03dff036c791f817f0c3
SSDEEP

3072:SgiSH5HRFVScyzTBxwAWJKwTZnTBfZyeO/yaAv:FdrVXyXBxFWJpTZnTBxyB/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1212	2032	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2032	2000	rundll32.exe	28
PID 2000 wrote to memory of 2032	2000	rundll32.exe	28
PID 2000 wrote to memory of 2032	2000	rundll32.exe	28
PID 2000 wrote to memory of 2032	2000	rundll32.exe	28
PID 2000 wrote to memory of 2032	2000	rundll32.exe	28
PID 2000 wrote to memory of 2032	2000	rundll32.exe	28
PID 2000 wrote to memory of 2032	2000	rundll32.exe	28
PID 2032 wrote to memory of 1212	2032	rundll32.exe	29
PID 2032 wrote to memory of 1212	2032	rundll32.exe	29
PID 2032 wrote to memory of 1212	2032	rundll32.exe	29
PID 2032 wrote to memory of 1212	2032	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1532-57-0x0000000000200000-0x000000000022A000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1532-57-0x0000000000200000-0x000000000022A000-memory.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 196
    3⤵
    - Program crash
    PID:1212

memory/2032-55-0x00000000767B1000-0x00000000767B3000-memory.dmp

Filesize
8KB

Download