ae1eab4bcda8cb733860fdc6c8d7dc21084b0c5ff2a03a7738cf7c505cf10be7

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
18-07-2023 16:50

Target

4740-145-0x0000000002AB0000-0x0000000002ABE000-memory.dll
Size

56KB
MD5

6c18a3380917fe9a573971f9df086130
SHA1

30deca4c64a5fd13dd55a71dcaaf697dcbd618e2
SHA256

ae1eab4bcda8cb733860fdc6c8d7dc21084b0c5ff2a03a7738cf7c505cf10be7
SHA512

548069a0d29592012147930e0ec99ea5921ceecdb7e305a0135594a391118c0923211a4992d465d7a1696d605de69b6ec287b637ca9c6af21455a8bd5aecd674
SSDEEP

768:A2fDQuJxEfnJpsy9tvpyuR4LNaX+jN43XepE9sc2MW/vYF68lU/w3DZcHy:hDVPEfnJpdj3V0ecfcWvYEOU/UDG

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2620 1184 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2620	1184	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1260 wrote to memory of 1184	1260	rundll32.exe	rundll32.exe
PID 1260 wrote to memory of 1184	1260	rundll32.exe	rundll32.exe
PID 1260 wrote to memory of 1184	1260	rundll32.exe	rundll32.exe
PID 1260 wrote to memory of 1184	1260	rundll32.exe	rundll32.exe
PID 1260 wrote to memory of 1184	1260	rundll32.exe	rundll32.exe
PID 1260 wrote to memory of 1184	1260	rundll32.exe	rundll32.exe
PID 1260 wrote to memory of 1184	1260	rundll32.exe	rundll32.exe
PID 1184 wrote to memory of 2620	1184	rundll32.exe	WerFault.exe
PID 1184 wrote to memory of 2620	1184	rundll32.exe	WerFault.exe
PID 1184 wrote to memory of 2620	1184	rundll32.exe	WerFault.exe
PID 1184 wrote to memory of 2620	1184	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4740-145-0x0000000002AB0000-0x0000000002ABE000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1260

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4740-145-0x0000000002AB0000-0x0000000002ABE000-memory.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1184 -s 196
3⤵
- Program crash
PID:2620