fdd7ebd0eafe38d33e0a3d42fdc4935266b35da063bc6874bc0ffd3cb05ff892

Resubmissions

22-09-2022 16:56

22-09-2022 16:46

13-09-2022 17:49

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
22-09-2022 16:46

Target

25c5264d16b42bf798913e90ecf32ea2.dll
Size

2.7MB
MD5

25c5264d16b42bf798913e90ecf32ea2
SHA1

24529aaf2ca70f05e148d49cd9f6a1fe398ec129
SHA256

fdd7ebd0eafe38d33e0a3d42fdc4935266b35da063bc6874bc0ffd3cb05ff892
SHA512

4d6124a0ca76b81cc9c899341d5e6384e3acc19cfad36ea4780f5d6c30968b92535acd347b36d82121ed8a845d372e2c0398a7c9815264a9da287a5440070dd5
SSDEEP

49152:Jzl1rpbUrqvv0v2rQVt8nqwI7lOOYcT2ek:P1Kqvv07noI7lOOYcl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2032	2044	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2044	1896	rundll32.exe	27
PID 1896 wrote to memory of 2044	1896	rundll32.exe	27
PID 1896 wrote to memory of 2044	1896	rundll32.exe	27
PID 1896 wrote to memory of 2044	1896	rundll32.exe	27
PID 1896 wrote to memory of 2044	1896	rundll32.exe	27
PID 1896 wrote to memory of 2044	1896	rundll32.exe	27
PID 1896 wrote to memory of 2044	1896	rundll32.exe	27
PID 2044 wrote to memory of 2032	2044	rundll32.exe	28
PID 2044 wrote to memory of 2032	2044	rundll32.exe	28
PID 2044 wrote to memory of 2032	2044	rundll32.exe	28
PID 2044 wrote to memory of 2032	2044	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\25c5264d16b42bf798913e90ecf32ea2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\25c5264d16b42bf798913e90ecf32ea2.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 196
    3⤵
    - Program crash
    PID:2032

memory/2044-55-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download