003fc07a2b652e3bc05433c5da917b5eb90a0f121906d4c39058d8e2f4b9b246

Analysis

max time kernel
31s
max time network
36s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
12/07/2023, 10:05

Target

2868-143-0x000000006D7C0000-0x000000006D858000-memory.dll
Size

608KB
MD5

276106a4ef267a0f7be3f42c5d5250a4
SHA1

4dd34bbeb9b4b10672be57f8e137926ac4accd9c
SHA256

003fc07a2b652e3bc05433c5da917b5eb90a0f121906d4c39058d8e2f4b9b246
SHA512

4c078bf301bd56ca9b30ba4eeec4291a0c031554e9cbff504680fc71eadb1261031a0d63ccd1886e304c8388d6b61774ec4d957aca73de4219dcfac81b4f4b37
SSDEEP

6144:c0RJihKmLAggMeSul3Tt4WaKCEO4IFtpnja8y+4Ewb4EA9WTKX:c0RJCKms3l3NHl4pjaQQb4nsK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1144	2700	WerFault.exe	17

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 1144	2700	rundll32.exe	28
PID 2700 wrote to memory of 1144	2700	rundll32.exe	28
PID 2700 wrote to memory of 1144	2700	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2868-143-0x000000006D7C0000-0x000000006D858000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2700 -s 56
  2⤵
  - Program crash
  PID:1144