35e53e30d07a5ee51dd1c8e8df09434d534db5bf5c884af02474485867d88dbe

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
27-03-2023 01:06

Target

befeb1ab986fae9a54d4761d072bf50fdbff5c6b1b89b66a6790a3f0bfc4243f.dll
Size

842KB
MD5

1821abde4a17d5c775e197217ca2a1d6
SHA1

b0bf8c2ed7ae2e6ecb5eb2275015343a712ab8b3
SHA256

befeb1ab986fae9a54d4761d072bf50fdbff5c6b1b89b66a6790a3f0bfc4243f
SHA512

e5d46a376692fe2348ec26b94c93ba304c9cc2da5ed81b734c894b3ec473a22f04591bee4b841a142f5b7659f5e4495a579aa0e49abe21002796b4647b06f73c
SSDEEP

24576:iX/wM8bxdVOcVYXNg31qU1c8/UxMzFni:i9EKNI8U68/U+zFn

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1312 1556 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1312	1556	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1556 wrote to memory of 1312	1556	rundll32.exe	WerFault.exe
PID 1556 wrote to memory of 1312	1556	rundll32.exe	WerFault.exe
PID 1556 wrote to memory of 1312	1556	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\befeb1ab986fae9a54d4761d072bf50fdbff5c6b1b89b66a6790a3f0bfc4243f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1556

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1556 -s 84
2⤵
- Program crash
PID:1312