9733f114f3e9f6a66cf980993480002dbdc661c008e180ee099ae8cde4f33737

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
17-03-2023 11:45

Target

520-90-0x00000000056D0000-0x0000000005711000-memory.dll
Size

260KB
MD5

11227a1eba14420b85f673e244ba7b79
SHA1

17767b0493ea169568d9bdf5a724eb301a5ba868
SHA256

9733f114f3e9f6a66cf980993480002dbdc661c008e180ee099ae8cde4f33737
SHA512

f29775479a2c45a8dbb0e4df8191b8037dda04ad2e688178298a85146fefd90971b8509461e2859afcf30ee66d096e943937cf5a8bfe90fd4169ed1b126a52f6
SSDEEP

3072:JchA951pSyIjSWtSX8IYGvLahv+KuMInNMzgr/ML4DAGVjlUm5ScSBS:JchWFSSW08IbvI+/MYaFL4DNjw

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1108 1216 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1108	1216	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1716 wrote to memory of 1216	1716	rundll32.exe	rundll32.exe
PID 1716 wrote to memory of 1216	1716	rundll32.exe	rundll32.exe
PID 1716 wrote to memory of 1216	1716	rundll32.exe	rundll32.exe
PID 1716 wrote to memory of 1216	1716	rundll32.exe	rundll32.exe
PID 1716 wrote to memory of 1216	1716	rundll32.exe	rundll32.exe
PID 1716 wrote to memory of 1216	1716	rundll32.exe	rundll32.exe
PID 1716 wrote to memory of 1216	1716	rundll32.exe	rundll32.exe
PID 1216 wrote to memory of 1108	1216	rundll32.exe	WerFault.exe
PID 1216 wrote to memory of 1108	1216	rundll32.exe	WerFault.exe
PID 1216 wrote to memory of 1108	1216	rundll32.exe	WerFault.exe
PID 1216 wrote to memory of 1108	1216	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\520-90-0x00000000056D0000-0x0000000005711000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1716

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\520-90-0x00000000056D0000-0x0000000005711000-memory.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 196
3⤵
- Program crash
PID:1108