b0e9693b49669a9b1e56fc33824642a8789469906455b2bdb03d50c186938c44

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/12/2022, 14:04

Target

3372-140-0x0000000000400000-0x0000000000495000-memory.dll
Size

596KB
MD5

acd0fc91e0c24024bf14bdd2b0b76361
SHA1

b3a857f0dd3ad9a7acb867d7a9eaf93a74c89bdb
SHA256

b0e9693b49669a9b1e56fc33824642a8789469906455b2bdb03d50c186938c44
SHA512

c52f5fdc2a83bff237dc75e9bd4055531540a675aa85750263b481e3279a97c3d73af3a3f2a51effac5dd21a4755dd01845d8cb7b04a0e75efacd5a11d0737e3
SSDEEP

768:L2HRfxRHbvvpywyV34OB9bl5n+iRjn9P1avZa9Bmr1h097mI5:kRfxR7Zjyt5+0zavZangX097m

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1860	964	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 964	1184	rundll32.exe	26
PID 1184 wrote to memory of 964	1184	rundll32.exe	26
PID 1184 wrote to memory of 964	1184	rundll32.exe	26
PID 1184 wrote to memory of 964	1184	rundll32.exe	26
PID 1184 wrote to memory of 964	1184	rundll32.exe	26
PID 1184 wrote to memory of 964	1184	rundll32.exe	26
PID 1184 wrote to memory of 964	1184	rundll32.exe	26
PID 964 wrote to memory of 1860	964	rundll32.exe	27
PID 964 wrote to memory of 1860	964	rundll32.exe	27
PID 964 wrote to memory of 1860	964	rundll32.exe	27
PID 964 wrote to memory of 1860	964	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3372-140-0x0000000000400000-0x0000000000495000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3372-140-0x0000000000400000-0x0000000000495000-memory.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 196
    3⤵
    - Program crash
    PID:1860

memory/964-55-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

Filesize
8KB

Download