3a5934e73c3c5351362a0a411113a228663b85e9dacd334a9bc35cf3aa6bea71

Analysis

max time kernel
73s
max time network
78s
platform
windows7_x64
resource
win7-20230705-en
resource tags

arch:x64arch:x86image:win7-20230705-enlocale:en-usos:windows7-x64system
submitted
10-07-2023 16:15

Target

3012-72-0x000007FEF5540000-0x000007FEF5C70000-memory.dll
Size

7.2MB
MD5

953ccba450ea197ddd041e2059193895
SHA1

fde4bf30b9fa25e8ab5d45ed4eed5bea16841928
SHA256

3a5934e73c3c5351362a0a411113a228663b85e9dacd334a9bc35cf3aa6bea71
SHA512

d76cf1c94e23987059cdfb26b903704672007e8ade9da7179cb0e962aa26f40e51989a91e15ce9c5f583cf07daeaa4a5b67629d9a2add5282338b48dbf7fcbd9
SSDEEP

196608:rxxUA5/MQSaVuoCev72/8tUG7YzDGaixTPnHXbQ:4ekHasovvsKUZforXbQ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2876 3036 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2876	3036	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3036 wrote to memory of 2876	3036	rundll32.exe	WerFault.exe
PID 3036 wrote to memory of 2876	3036	rundll32.exe	WerFault.exe
PID 3036 wrote to memory of 2876	3036	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3012-72-0x000007FEF5540000-0x000007FEF5C70000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3036

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3036 -s 56
2⤵
- Program crash
PID:2876