b95c4f354f85a335502b63cbea99686ab2129897d7a81fa096a8ad80c6424eb4

Analysis

max time kernel
38s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08-09-2022 06:09

Target

txtonly.dll
Size

11KB
MD5

5bb212389d37da3efb3063fb62d478c5
SHA1

db4919984b95e101abab7502910a7994ab849bbe
SHA256

cdacd102c721a2b486dbe2c68a61d243772913aa8805275f95ea3451a6ac7dae
SHA512

ec10b094f8d11ed6d0c4edd01b798aace665942c54731db9807805c3cdff6b3170e056ae6b9a28fda56677f6b40e5bc43beb7bfdb23a3a4ecfd2da24741ed0c4
SSDEEP

48:6GJpXEl9rWm7bLk33jEECm7vWxtlZW8IKL/hll5WGJqlkHk2KJ+fGfGfnfC5upCM:M7BIwtjWxIZlDWxkHAT529PNVE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1772	1996	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1996	2004	rundll32.exe	26
PID 2004 wrote to memory of 1996	2004	rundll32.exe	26
PID 2004 wrote to memory of 1996	2004	rundll32.exe	26
PID 2004 wrote to memory of 1996	2004	rundll32.exe	26
PID 2004 wrote to memory of 1996	2004	rundll32.exe	26
PID 2004 wrote to memory of 1996	2004	rundll32.exe	26
PID 2004 wrote to memory of 1996	2004	rundll32.exe	26
PID 1996 wrote to memory of 1772	1996	rundll32.exe	27
PID 1996 wrote to memory of 1772	1996	rundll32.exe	27
PID 1996 wrote to memory of 1772	1996	rundll32.exe	27
PID 1996 wrote to memory of 1772	1996	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\txtonly.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\txtonly.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 228
    3⤵
    - Program crash
    PID:1772

memory/1996-55-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download