dbdd38479854515348488b9bbc94698710b2edf2245bef0ad15defce1d9f4580

Analysis

max time kernel
28s
max time network
54s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
14-09-2022 02:26

Target

12551/NOISE_FULL_B_24/unrar.dll
Size

154KB
MD5

3fda563a0d2742c0a2475459a1619a28
SHA1

43acbf63a1e8170450709745043a86fe908e8f31
SHA256

fb5549b9e61fe4ce603545edf6e02086e0e5eb02429ca88ac09c5fe79fbf94f0
SHA512

4735e6d1b6c41efbb0179644c6cfed949c048ff112d08dbcb55ab1f65aaaf406fe69bd95dd785cd4e4366db33fb3e3928d87f871d5f063bc59806b9859418438
SSDEEP

3072:87Qdumw6LCZpzw9q2tt3r0hubP1oRYbssQ/nz7z6JIAzk7vSMoyjAq5cqHz9ZM6:TdLwjZpzO9z3rbb2ugB/nz7WyjAqeqHp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1516	1528	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 1528	1196	rundll32.exe	27
PID 1196 wrote to memory of 1528	1196	rundll32.exe	27
PID 1196 wrote to memory of 1528	1196	rundll32.exe	27
PID 1196 wrote to memory of 1528	1196	rundll32.exe	27
PID 1196 wrote to memory of 1528	1196	rundll32.exe	27
PID 1196 wrote to memory of 1528	1196	rundll32.exe	27
PID 1196 wrote to memory of 1528	1196	rundll32.exe	27
PID 1528 wrote to memory of 1516	1528	rundll32.exe	28
PID 1528 wrote to memory of 1516	1528	rundll32.exe	28
PID 1528 wrote to memory of 1516	1528	rundll32.exe	28
PID 1528 wrote to memory of 1516	1528	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12551\NOISE_FULL_B_24\unrar.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\12551\NOISE_FULL_B_24\unrar.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 228
    3⤵
    - Program crash
    PID:1516

memory/1516-57-0x0000000000000000-mapping.dmp

Download
memory/1528-54-0x0000000000000000-mapping.dmp

Download
memory/1528-55-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/1528-56-0x0000000000210000-0x0000000000242000-memory.dmp

Filesize
200KB

Download