85c7975c0755b242ab0de2c68bad51a8f6cb0eb9f3ea2b2bdce9168d48043a06

Analysis

Target

85c7975c0755b242ab0de2c68bad51a8f6cb0eb9f3ea2b2bdce9168d48043a06.dll
Size

199KB
MD5

9a0cd65ba55d5446b2c83fb8b608ddce
SHA1

854eaee1a1c94cb13960ce99b43ac16e1fc6f06f
SHA256

85c7975c0755b242ab0de2c68bad51a8f6cb0eb9f3ea2b2bdce9168d48043a06
SHA512

4ef0f9255aaa5537f17f7ec2f6eb23714347baa90158637534077054e3144089936c0cf85f0f8b45ae28782c23e6b4dbf656afb13bf24aff092c45cace46a8fb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
952	1708	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 1708	1692	rundll32.exe	28
PID 1692 wrote to memory of 1708	1692	rundll32.exe	28
PID 1692 wrote to memory of 1708	1692	rundll32.exe	28
PID 1692 wrote to memory of 1708	1692	rundll32.exe	28
PID 1692 wrote to memory of 1708	1692	rundll32.exe	28
PID 1692 wrote to memory of 1708	1692	rundll32.exe	28
PID 1692 wrote to memory of 1708	1692	rundll32.exe	28
PID 1708 wrote to memory of 952	1708	rundll32.exe	29
PID 1708 wrote to memory of 952	1708	rundll32.exe	29
PID 1708 wrote to memory of 952	1708	rundll32.exe	29
PID 1708 wrote to memory of 952	1708	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\85c7975c0755b242ab0de2c68bad51a8f6cb0eb9f3ea2b2bdce9168d48043a06.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\85c7975c0755b242ab0de2c68bad51a8f6cb0eb9f3ea2b2bdce9168d48043a06.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 224
    3⤵
    - Program crash
    PID:952

memory/1708-55-0x00000000763E1000-0x00000000763E3000-memory.dmp

Filesize
8KB

Download