e1daf460c47bd7d01c1a2761cbe8b522277e23aa33c31452ba7d89ffa0d1f3d2

Analysis

max time kernel
118s
max time network
147s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 13:27

Target

2920-1-0x00000000001B0000-0x00000000001BE000-memory.dll
Size

56KB
MD5

1cf21c0bbe89e58e75d77ef2b0444247
SHA1

23745fd565cc616a3ebf7ac4044f201ac834bd9c
SHA256

e1daf460c47bd7d01c1a2761cbe8b522277e23aa33c31452ba7d89ffa0d1f3d2
SHA512

b5b237bc1c7eee9f0d77c10bd7ddf074855af81c63454b197728536a19996876a29493b0186ce2cbfb5daef4ed7e27be6b52dabb7425d5d7891810c6eb3b93fa
SSDEEP

768:A2kXSxZFHCUaQ+73M3yvx0ya8Kl7aQixYgxYJmv0NHY7lbjNltdX20JJ:eCxZ8UaQ+73M3dBVJaf3C7YJj3HG0JJ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2448 2488 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2448	2488	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1016 wrote to memory of 2488	1016	rundll32.exe	rundll32.exe
PID 1016 wrote to memory of 2488	1016	rundll32.exe	rundll32.exe
PID 1016 wrote to memory of 2488	1016	rundll32.exe	rundll32.exe
PID 1016 wrote to memory of 2488	1016	rundll32.exe	rundll32.exe
PID 1016 wrote to memory of 2488	1016	rundll32.exe	rundll32.exe
PID 1016 wrote to memory of 2488	1016	rundll32.exe	rundll32.exe
PID 1016 wrote to memory of 2488	1016	rundll32.exe	rundll32.exe
PID 2488 wrote to memory of 2448	2488	rundll32.exe	WerFault.exe
PID 2488 wrote to memory of 2448	2488	rundll32.exe	WerFault.exe
PID 2488 wrote to memory of 2448	2488	rundll32.exe	WerFault.exe
PID 2488 wrote to memory of 2448	2488	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2920-1-0x00000000001B0000-0x00000000001BE000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1016

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2920-1-0x00000000001B0000-0x00000000001BE000-memory.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 196
3⤵
- Program crash
PID:2448