bd5c4675cd3864147cfe677765a6f949b5b2ab2b70ef73525af994393dc6f0e7

Analysis

max time kernel
35s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 15:16

Target

bd5c4675cd3864147cfe677765a6f949b5b2ab2b70ef73525af994393dc6f0e7.dll
Size

102KB
MD5

0a9267abf7f75b732cb5bb7f0f612fe6
SHA1

28fccfdb1f2b92e627fc875f1c7d04359c1bc011
SHA256

bd5c4675cd3864147cfe677765a6f949b5b2ab2b70ef73525af994393dc6f0e7
SHA512

ee0cb01eadc7419d5a26a5a13ccaedc8d0c565b9f6b9a14208858a60d62b67f9aafd977e68b8a8416145bb4aba77c7311accd5dd68dc3403de2b38a71afda783
SSDEEP

1536:6Msa6kRfJirY84erfImafc61JfcUcKDRA8/HUtpFXCAIu:6Va6wiraf91JcUcw/HUtpFXCAIu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2000	1704	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1704	1928	rundll32.exe	26
PID 1928 wrote to memory of 1704	1928	rundll32.exe	26
PID 1928 wrote to memory of 1704	1928	rundll32.exe	26
PID 1928 wrote to memory of 1704	1928	rundll32.exe	26
PID 1928 wrote to memory of 1704	1928	rundll32.exe	26
PID 1928 wrote to memory of 1704	1928	rundll32.exe	26
PID 1928 wrote to memory of 1704	1928	rundll32.exe	26
PID 1704 wrote to memory of 2000	1704	rundll32.exe	27
PID 1704 wrote to memory of 2000	1704	rundll32.exe	27
PID 1704 wrote to memory of 2000	1704	rundll32.exe	27
PID 1704 wrote to memory of 2000	1704	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd5c4675cd3864147cfe677765a6f949b5b2ab2b70ef73525af994393dc6f0e7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd5c4675cd3864147cfe677765a6f949b5b2ab2b70ef73525af994393dc6f0e7.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 260
    3⤵
    - Program crash
    PID:2000

memory/1704-55-0x00000000762B1000-0x00000000762B3000-memory.dmp

Filesize
8KB

Download