fd77f3d120cdda8531722d2df8874cb17c7c1fecb7bf7478f9b947b1768c73d8

Analysis

max time kernel
29s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
18/03/2023, 01:48

Target

1284-68-0x00000000003A0000-0x00000000003A9000-memory.dll
Size

36KB
MD5

b47634d99ca70183b92ee87b07a101ec
SHA1

b2e0e70dd90b1f4cee6588cbae941a4fae536e40
SHA256

fd77f3d120cdda8531722d2df8874cb17c7c1fecb7bf7478f9b947b1768c73d8
SHA512

0e354476a6a5a06bfde3c680f9737bb7d3d9c5cda79adf484b23ad18c6c293585dfeb7609247d5afc2feec6415ed752f69602a86a9b5884ad5fb3bc9bce8bf2a
SSDEEP

192:6P+nM5KC/zxayGc3gzq7YjDaqzJCueT+RfbZne9s6PLwqW4P0tkYGijY:s5Jxayczq7Yjt9lfle9s6PLUE6kYGi8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1484	1100	WerFault.exe	16

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 1484	1100	rundll32.exe	27
PID 1100 wrote to memory of 1484	1100	rundll32.exe	27
PID 1100 wrote to memory of 1484	1100	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1284-68-0x00000000003A0000-0x00000000003A9000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1100 -s 56
  2⤵
  - Program crash
  PID:1484