38dc89dad1485a7865f56642a8acbcf176b2dba8bd5fecdf8f3ced239e1d770b

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 07:53

Target

2968-12-0x00000000054C0000-0x0000000005501000-memory.dll
Size

260KB
MD5

4d09b4964269ac11780c530783aaa155
SHA1

96a805afbf1294e909451d4d4ccbf6c9ca88e41e
SHA256

38dc89dad1485a7865f56642a8acbcf176b2dba8bd5fecdf8f3ced239e1d770b
SHA512

f3983e1ef02469244246a766b1b3c359d6d08849c0b23a53721243ecfabc586218bed874e03d7a8754e73a0ec37bcab14b02edd272b25136088b695b938bf330
SSDEEP

3072:NY2vCzrLSp6ard/I8IWkFxwcFHzchZ2CEmAe9JXD1jRUT5o7GBS:C20GJrdA8I7hFTqRP9JXpjO

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1508 1524 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1508	1524	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1556 wrote to memory of 1524	1556	rundll32.exe	rundll32.exe
PID 1556 wrote to memory of 1524	1556	rundll32.exe	rundll32.exe
PID 1556 wrote to memory of 1524	1556	rundll32.exe	rundll32.exe
PID 1556 wrote to memory of 1524	1556	rundll32.exe	rundll32.exe
PID 1556 wrote to memory of 1524	1556	rundll32.exe	rundll32.exe
PID 1556 wrote to memory of 1524	1556	rundll32.exe	rundll32.exe
PID 1556 wrote to memory of 1524	1556	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 1508	1524	rundll32.exe	WerFault.exe
PID 1524 wrote to memory of 1508	1524	rundll32.exe	WerFault.exe
PID 1524 wrote to memory of 1508	1524	rundll32.exe	WerFault.exe
PID 1524 wrote to memory of 1508	1524	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2968-12-0x00000000054C0000-0x0000000005501000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1556

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2968-12-0x00000000054C0000-0x0000000005501000-memory.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 196
3⤵
- Program crash
PID:1508