fdd7ebd0eafe38d33e0a3d42fdc4935266b35da063bc6874bc0ffd3cb05ff892

Resubmissions

22-09-2022 16:56

22-09-2022 16:46

13-09-2022 17:49

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
22-09-2022 16:56

Target

25c5264d16b42bf798913e90ecf32ea2.dll
Size

2.7MB
MD5

25c5264d16b42bf798913e90ecf32ea2
SHA1

24529aaf2ca70f05e148d49cd9f6a1fe398ec129
SHA256

fdd7ebd0eafe38d33e0a3d42fdc4935266b35da063bc6874bc0ffd3cb05ff892
SHA512

4d6124a0ca76b81cc9c899341d5e6384e3acc19cfad36ea4780f5d6c30968b92535acd347b36d82121ed8a845d372e2c0398a7c9815264a9da287a5440070dd5
SSDEEP

49152:Jzl1rpbUrqvv0v2rQVt8nqwI7lOOYcT2ek:P1Kqvv07noI7lOOYcl

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1164 992 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1164	992	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 240 wrote to memory of 992	240	rundll32.exe	rundll32.exe
PID 240 wrote to memory of 992	240	rundll32.exe	rundll32.exe
PID 240 wrote to memory of 992	240	rundll32.exe	rundll32.exe
PID 240 wrote to memory of 992	240	rundll32.exe	rundll32.exe
PID 240 wrote to memory of 992	240	rundll32.exe	rundll32.exe
PID 240 wrote to memory of 992	240	rundll32.exe	rundll32.exe
PID 240 wrote to memory of 992	240	rundll32.exe	rundll32.exe
PID 992 wrote to memory of 1164	992	rundll32.exe	WerFault.exe
PID 992 wrote to memory of 1164	992	rundll32.exe	WerFault.exe
PID 992 wrote to memory of 1164	992	rundll32.exe	WerFault.exe
PID 992 wrote to memory of 1164	992	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\25c5264d16b42bf798913e90ecf32ea2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\25c5264d16b42bf798913e90ecf32ea2.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 196
    3⤵
    - Program crash
    PID:1164

memory/992-54-0x0000000000000000-mapping.dmp

Download
memory/992-55-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/1164-56-0x0000000000000000-mapping.dmp

Download