6818f151780b3f545b9f92cf81b985d1ce14a16b7c55fcc6644b5fad4b81696e

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24/03/2023, 03:43

Target

1668-54-0x0000000000140000-0x0000000000192000-memory.dll
Size

328KB
MD5

52fc69f58052172174e41238422b196f
SHA1

691fcf5007878cb4d368c06903333167429c1ad0
SHA256

6818f151780b3f545b9f92cf81b985d1ce14a16b7c55fcc6644b5fad4b81696e
SHA512

a102ef24ff59d79527eaa402cec970b9530828d46b8710994537771e451d96788d3c677042bb7d6228797e069614fc5dbaaf1be9dce2bf6340b16ff35ccaedfe
SSDEEP

3072:ZzbINhWl+CIbfqqEVxtfg8jtfDCJS4l9JTFyG+JteEzCnLG/vIftkYJT6vzHk:ZzbUWootfDCvT4ZTXzCLG/Ekx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1984	1972	WerFault.exe	22

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1984	1972	rundll32.exe	28
PID 1972 wrote to memory of 1984	1972	rundll32.exe	28
PID 1972 wrote to memory of 1984	1972	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-54-0x0000000000140000-0x0000000000192000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1972 -s 56
  2⤵
  - Program crash
  PID:1984