56af847e5b4cf295e44d70b2acfa91c06710d97f7d9843c3b5ecd1aea99e26e5

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
17/08/2023, 13:05

Target

2468-140-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

41bf0651d00dde92aa78a1c50b5c5527
SHA1

f79635ddbaa1e0242f17c60578dca60d0eb40d3c
SHA256

56af847e5b4cf295e44d70b2acfa91c06710d97f7d9843c3b5ecd1aea99e26e5
SHA512

fdc009d3838736a58b3fb4b4a511672494f894f10170f3baedde1a02ba548e9cba385d9243877f1e3c2a157f0e5087127378b378b2e78fa6cf26c059fbadd08c
SSDEEP

384:s5Jxayczq7Yjt9lfle9s6PLfA6kYGi8N:s5DHYeIlfle9HDfGiy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2600	2588	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 2600	2588	rundll32.exe	28
PID 2588 wrote to memory of 2600	2588	rundll32.exe	28
PID 2588 wrote to memory of 2600	2588	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2468-140-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2588 -s 56
  2⤵
  - Program crash
  PID:2600