60868f4b22531612ddc2884a8bba98e0ee3a0ff85c6162c9041fa4f47c6dd39e

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-03-2024 11:09

Target

2044-76-0x00000000050A0000-0x00000000050D4000-memory.dll
Size

208KB
MD5

e6d343135863c5d89967e639e5c15fcd
SHA1

508f4686fcb1410bda90a03c46f19405bc340a44
SHA256

60868f4b22531612ddc2884a8bba98e0ee3a0ff85c6162c9041fa4f47c6dd39e
SHA512

c493e517e9c050ac4feb380cbff230b690d254740f616b685530e5f1951e1d60b70a5d19e8baeced7d65f498fb4d25683f1db36ea406b880c1d9f56afe91fabd
SSDEEP

3072:ZnT2RRXuwcN3OQXB8CITr9VV2ILe126JyTuBdjdUkB5Wpj:ZwXupN1x8CgBbRLDTuLj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2592 2840 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2592	2840	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2488 wrote to memory of 2840	2488	rundll32.exe	rundll32.exe
PID 2488 wrote to memory of 2840	2488	rundll32.exe	rundll32.exe
PID 2488 wrote to memory of 2840	2488	rundll32.exe	rundll32.exe
PID 2488 wrote to memory of 2840	2488	rundll32.exe	rundll32.exe
PID 2488 wrote to memory of 2840	2488	rundll32.exe	rundll32.exe
PID 2488 wrote to memory of 2840	2488	rundll32.exe	rundll32.exe
PID 2488 wrote to memory of 2840	2488	rundll32.exe	rundll32.exe
PID 2840 wrote to memory of 2592	2840	rundll32.exe	WerFault.exe
PID 2840 wrote to memory of 2592	2840	rundll32.exe	WerFault.exe
PID 2840 wrote to memory of 2592	2840	rundll32.exe	WerFault.exe
PID 2840 wrote to memory of 2592	2840	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-76-0x00000000050A0000-0x00000000050D4000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2488

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-76-0x00000000050A0000-0x00000000050D4000-memory.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 232
3⤵
- Program crash
PID:2592