5ff1d8742f12a83e7691418b078394ce01c1d1acae2d5269abc80f07940376a4

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
31-07-2022 07:56

Target

AHX26VNWHVDPF57JN4B27233L8.dll
Size

4.5MB
MD5

495e812df4d0ee7ed1324714bfb6ffef
SHA1

4e5ba8b4695bc60b272f7b60d342e48e440a4f7a
SHA256

9d9d3795c0df6d9098db13768ef6a3893d58ea1b7a9a1279b7ee15ed51d53028
SHA512

4088e84e436d701f87625b6393b07e0a18e210961d817ea8919e5f76bed5131ba9bb54f958fb212461e1461dbbe0d9178bae690412f6be771fb69c75f6f2cbe6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2032	944	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 944	1724	rundll32.exe	28
PID 1724 wrote to memory of 944	1724	rundll32.exe	28
PID 1724 wrote to memory of 944	1724	rundll32.exe	28
PID 1724 wrote to memory of 944	1724	rundll32.exe	28
PID 1724 wrote to memory of 944	1724	rundll32.exe	28
PID 1724 wrote to memory of 944	1724	rundll32.exe	28
PID 1724 wrote to memory of 944	1724	rundll32.exe	28
PID 944 wrote to memory of 2032	944	rundll32.exe	29
PID 944 wrote to memory of 2032	944	rundll32.exe	29
PID 944 wrote to memory of 2032	944	rundll32.exe	29
PID 944 wrote to memory of 2032	944	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AHX26VNWHVDPF57JN4B27233L8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AHX26VNWHVDPF57JN4B27233L8.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 944 -s 300
    3⤵
    - Program crash
    PID:2032

memory/944-55-0x0000000075C91000-0x0000000075C93000-memory.dmp

Filesize
8KB

Download
memory/944-56-0x0000000002190000-0x00000000026A1000-memory.dmp

Filesize
5.1MB

Download