9cab37c37d4a7f31f96b441311773fca315e306cbc0eff8b0679d5efec5b75c0

Analysis

max time kernel
28s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22-02-2023 09:48

Target

1204-57-0x000007FEF5790000-0x000007FEF610B000-memory.dll
Size

9.5MB
MD5

3007588b698821f51d99f9c5d9805744
SHA1

83faa9c6ad99f82464b9d23f394f59f02395ed40
SHA256

9cab37c37d4a7f31f96b441311773fca315e306cbc0eff8b0679d5efec5b75c0
SHA512

5c2ebc01162337074eb07c2a48e37fc52178890b63acc45f6ab1d68b60d4b30498101a13900f524110c8303be1f4c5cfce710b617fe0ad179590b4e45805b18e
SSDEEP

196608:zbDORRPCI3GT+gE4JrY2ByYHoFO+nDByE8:zbDOPPJ3X4e28nFjDEB

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1680 904 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1680	904	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 904 wrote to memory of 1680	904	rundll32.exe	WerFault.exe
PID 904 wrote to memory of 1680	904	rundll32.exe	WerFault.exe
PID 904 wrote to memory of 1680	904	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1204-57-0x000007FEF5790000-0x000007FEF610B000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:904

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 904 -s 56
2⤵
- Program crash
PID:1680