0123e9c445f558d6af0b8eaea786f7b429a4195a0ec1f3e56bf5bd42f4ca075d

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
18-07-2023 16:53

Target

4948-145-0x0000000002740000-0x000000000274E000-memory.dll
Size

56KB
MD5

3c881154f90736ea3c69a9e0ab01cd85
SHA1

899a1eb85f4ac78fe625268cf4bbef95e82ada3f
SHA256

0123e9c445f558d6af0b8eaea786f7b429a4195a0ec1f3e56bf5bd42f4ca075d
SHA512

97ec4ad9bafe8be0ec9f3a5e4ecd68259c636775effe7861412b7855c20df330c808b099518e5d63be3649bed440c7e2898c60642caf21ae3b0b20947b6bc78d
SSDEEP

768:A2gGoxu8EfnJhZn96vSyuR4LNaX+jN43XepE9sc2MW/vYF68lU/w3DZcHy:GGifEfnJhTx3V0ecfcWvYEOU/UDG

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1248 2236 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1248	2236	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2224 wrote to memory of 2236	2224	rundll32.exe	rundll32.exe
PID 2224 wrote to memory of 2236	2224	rundll32.exe	rundll32.exe
PID 2224 wrote to memory of 2236	2224	rundll32.exe	rundll32.exe
PID 2224 wrote to memory of 2236	2224	rundll32.exe	rundll32.exe
PID 2224 wrote to memory of 2236	2224	rundll32.exe	rundll32.exe
PID 2224 wrote to memory of 2236	2224	rundll32.exe	rundll32.exe
PID 2224 wrote to memory of 2236	2224	rundll32.exe	rundll32.exe
PID 2236 wrote to memory of 1248	2236	rundll32.exe	WerFault.exe
PID 2236 wrote to memory of 1248	2236	rundll32.exe	WerFault.exe
PID 2236 wrote to memory of 1248	2236	rundll32.exe	WerFault.exe
PID 2236 wrote to memory of 1248	2236	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4948-145-0x0000000002740000-0x000000000274E000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2224

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4948-145-0x0000000002740000-0x000000000274E000-memory.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 196
3⤵
- Program crash
PID:1248