503ed60e3a300ae9ea5233fb2aeaea7bfcfc9799123a0f4b2262628cbada87a7

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-09-2022 10:31

Target

5860000.dll
Size

227KB
MD5

f145cd724520de906d99653c6887f7bd
SHA1

fb36ec37b7f76683b70409b2c9e6c91476cb6489
SHA256

503ed60e3a300ae9ea5233fb2aeaea7bfcfc9799123a0f4b2262628cbada87a7
SHA512

42e899699d333414145ad76f32bebbd287878e686d4605cea583dcdee2cea3cccbe1d71e5547f285bc9af585c625334111544c45d6f6ae87983fa3b6c736b625
SSDEEP

1536:3XwJehihRFFZ78MzkaAhuLxXqFANIdmbVWGdsH6xQyOCybwNgh2gQ8+RbI7iurDO:35hinZgCo+NjJWSsm/OCyb/n8bI7iADO

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
1916	1736	WerFault.exe	25

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 1736 wrote to memory of 1916	1736	rundll32.exe	27
PID 1736 wrote to memory of 1916	1736	rundll32.exe	27
PID 1736 wrote to memory of 1916	1736	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5860000.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1736 -s 56
  2⤵
  - Program crash
  PID:1916