e1daf460c47bd7d01c1a2761cbe8b522277e23aa33c31452ba7d89ffa0d1f3d2

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 13:27

Target

2920-1-0x00000000001B0000-0x00000000001BE000-memory.dll
Size

56KB
MD5

1cf21c0bbe89e58e75d77ef2b0444247
SHA1

23745fd565cc616a3ebf7ac4044f201ac834bd9c
SHA256

e1daf460c47bd7d01c1a2761cbe8b522277e23aa33c31452ba7d89ffa0d1f3d2
SHA512

b5b237bc1c7eee9f0d77c10bd7ddf074855af81c63454b197728536a19996876a29493b0186ce2cbfb5daef4ed7e27be6b52dabb7425d5d7891810c6eb3b93fa
SSDEEP

768:A2kXSxZFHCUaQ+73M3yvx0ya8Kl7aQixYgxYJmv0NHY7lbjNltdX20JJ:eCxZ8UaQ+73M3dBVJaf3C7YJj3HG0JJ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2300 2584 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2300	2584	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2808 wrote to memory of 2584	2808	rundll32.exe	rundll32.exe
PID 2808 wrote to memory of 2584	2808	rundll32.exe	rundll32.exe
PID 2808 wrote to memory of 2584	2808	rundll32.exe	rundll32.exe
PID 2808 wrote to memory of 2584	2808	rundll32.exe	rundll32.exe
PID 2808 wrote to memory of 2584	2808	rundll32.exe	rundll32.exe
PID 2808 wrote to memory of 2584	2808	rundll32.exe	rundll32.exe
PID 2808 wrote to memory of 2584	2808	rundll32.exe	rundll32.exe
PID 2584 wrote to memory of 2300	2584	rundll32.exe	WerFault.exe
PID 2584 wrote to memory of 2300	2584	rundll32.exe	WerFault.exe
PID 2584 wrote to memory of 2300	2584	rundll32.exe	WerFault.exe
PID 2584 wrote to memory of 2300	2584	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2920-1-0x00000000001B0000-0x00000000001BE000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2920-1-0x00000000001B0000-0x00000000001BE000-memory.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 196
    3⤵
    - Program crash
    PID:2300