0058b4f69b0e6b9fc2eaca10a9bfb41e72e6cd72a827f8740fefde876194bade

Analysis

max time kernel
28s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08-09-2022 02:29

Target

PowerISO/App/PowerISO64/UnRAR64.dll
Size

327KB
MD5

cbc0cb091c34f46774b38971ffaadc30
SHA1

31a0e2c69233f741154c77f0449021f264d2c679
SHA256

d98d274733eabc6a7e425c6549c6b28fc61e850a0ac5f3c103b2d3efdb99b019
SHA512

faab994b48c42bdd4d2d3425aa6ec448520d91c43279ebf36d3e386261c7223d0ca20f77009fde12ee2a9c65e7e4e587292e9d58ce9c278b68c65a7ee92194bc
SSDEEP

6144:+8LjvC0vI441XRf9++UtIwOUVg4YTle7QwDAKPBFoaIO7H:+CK0vIDl+JawyTlpCPbs2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1236	1348	WerFault.exe	25

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 1236	1348	rundll32.exe	26
PID 1348 wrote to memory of 1236	1348	rundll32.exe	26
PID 1348 wrote to memory of 1236	1348	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PowerISO\App\PowerISO64\UnRAR64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1348 -s 124
  2⤵
  - Program crash
  PID:1236