e6648ec933fc75d78621f4be11b2391949c65e1822316a4d56d5ebd9a008a544

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
16-12-2022 18:02

Target

1040-69-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

82f3668d33bae502d93b1a35612c949c
SHA1

81254cf91be54c2fec8b1a9ef34a1696c1901e0c
SHA256

e6648ec933fc75d78621f4be11b2391949c65e1822316a4d56d5ebd9a008a544
SHA512

5b09647aadb8b907497a34ffc4f3bfc74f54c6b9be17c447fc3a482bc322bca55ceb529a4ac006ea8f793b91b00720893290760b5a41c10c40c535d880b28d08
SSDEEP

192:6P+nM5KC/zxayGc3gzq7YjDaqzJCueT+RfbZne9s6PL2P0tkYGijYZ:s5Jxayczq7Yjt9lfle9s6PLO6kYGi8

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1776 1516 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1776	1516	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1516 wrote to memory of 1776	1516	rundll32.exe	WerFault.exe
PID 1516 wrote to memory of 1776	1516	rundll32.exe	WerFault.exe
PID 1516 wrote to memory of 1776	1516	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1040-69-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1516

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1516 -s 56
2⤵
- Program crash
PID:1776