a5a291a48263f8240c9fe0a59eee972193cc70a701d7895f5d5f99c3681f6361

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 09:27

Target

a5a291a48263f8240c9fe0a59eee972193cc70a701d7895f5d5f99c3681f6361.dll
Size

92KB
MD5

65ba33dd403405711a436cbdb09340dd
SHA1

25a7d468c5cd70dfed6a0da8c4058e608d01c852
SHA256

a5a291a48263f8240c9fe0a59eee972193cc70a701d7895f5d5f99c3681f6361
SHA512

4a701084d1c220594812cfdfbe8bdccf6b3f92692f2c5299e43d6b04559f1465b41e6c609c247701378782c393d60dfd74d84c38c75d7c517277aa6e326c1bd5
SSDEEP

1536:+ID7mEVe+fsZr0ItmnKXH99P5ju7/a9Z9OFS:JD6+C0IkKTPFuDa9ZI4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1804	1932	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 1932	1660	rundll32.exe	27
PID 1660 wrote to memory of 1932	1660	rundll32.exe	27
PID 1660 wrote to memory of 1932	1660	rundll32.exe	27
PID 1660 wrote to memory of 1932	1660	rundll32.exe	27
PID 1660 wrote to memory of 1932	1660	rundll32.exe	27
PID 1660 wrote to memory of 1932	1660	rundll32.exe	27
PID 1660 wrote to memory of 1932	1660	rundll32.exe	27
PID 1932 wrote to memory of 1804	1932	rundll32.exe	28
PID 1932 wrote to memory of 1804	1932	rundll32.exe	28
PID 1932 wrote to memory of 1804	1932	rundll32.exe	28
PID 1932 wrote to memory of 1804	1932	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a5a291a48263f8240c9fe0a59eee972193cc70a701d7895f5d5f99c3681f6361.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a5a291a48263f8240c9fe0a59eee972193cc70a701d7895f5d5f99c3681f6361.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 252
    3⤵
    - Program crash
    PID:1804

memory/1932-55-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download