8add857dfc19d6efbe0a34955f6b01a9b78c69c0720e4b67f49c0d7a91a3ba15

Analysis

max time kernel
40s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/12/2022, 02:20

Target

4524-147-0x00000000021E0000-0x0000000002275000-memory.dll
Size

596KB
MD5

1d392cea60039d646a0c827de1d90261
SHA1

b65c5fb4d0a8e221e6b604ae570798e95ca97491
SHA256

8add857dfc19d6efbe0a34955f6b01a9b78c69c0720e4b67f49c0d7a91a3ba15
SHA512

b29a957f531c08a73511a28e8b1f2b202bbf6dc651fe64b4e0f26658f304e5d4de5531fcbbfc5e64d24c8a862dcc2a80e8a182d9cb8ecb70b7c47f79f905bff3
SSDEEP

768:L2Hhn3rXzv9ywyV34OB9bl5n+iRjn9P1avZa9Bmr1h097mI5:shn3zxjyt5+0zavZangX097m

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1336	1460	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1460 wrote to memory of 1336	1460	rundll32.exe	27
PID 1460 wrote to memory of 1336	1460	rundll32.exe	27
PID 1460 wrote to memory of 1336	1460	rundll32.exe	27
PID 1460 wrote to memory of 1336	1460	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4524-147-0x00000000021E0000-0x0000000002275000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4524-147-0x00000000021E0000-0x0000000002275000-memory.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 196
    3⤵
    - Program crash
    PID:1336

memory/1460-55-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download