503ed60e3a300ae9ea5233fb2aeaea7bfcfc9799123a0f4b2262628cbada87a7

Analysis

max time kernel
38s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-09-2022 10:33

Target

5860000.dll
Size

227KB
MD5

f145cd724520de906d99653c6887f7bd
SHA1

fb36ec37b7f76683b70409b2c9e6c91476cb6489
SHA256

503ed60e3a300ae9ea5233fb2aeaea7bfcfc9799123a0f4b2262628cbada87a7
SHA512

42e899699d333414145ad76f32bebbd287878e686d4605cea583dcdee2cea3cccbe1d71e5547f285bc9af585c625334111544c45d6f6ae87983fa3b6c736b625
SSDEEP

1536:3XwJehihRFFZ78MzkaAhuLxXqFANIdmbVWGdsH6xQyOCybwNgh2gQ8+RbI7iurDO:35hinZgCo+NjJWSsm/OCyb/n8bI7iADO

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
1988	544	WerFault.exe	25

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 544 wrote to memory of 1988	544	rundll32.exe	26
PID 544 wrote to memory of 1988	544	rundll32.exe	26
PID 544 wrote to memory of 1988	544	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5860000.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:544
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 544 -s 56
  2⤵
  - Program crash
  PID:1988