70194fa71d9d9c32fa9aedc3c386be901a4c1a22cc2f3951d3f370807411c462

Analysis

max time kernel
38s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 13:12

Target

70194fa71d9d9c32fa9aedc3c386be901a4c1a22cc2f3951d3f370807411c462.dll
Size

173KB
MD5

6c5e2f316fd9eac7b6bddedfd16b3dce
SHA1

8e7cbbc422734ffc150135f2e88e79c0cb2b5552
SHA256

70194fa71d9d9c32fa9aedc3c386be901a4c1a22cc2f3951d3f370807411c462
SHA512

951384120ed29f6f1fe167735a11620f094c9f9bc381e5ae454e1644a6db2b6913b8f7cc5fafb3c482602cafc2cc5540fd5512e7fc0bbeaac85c5c38df69970b
SSDEEP

3072:GAAPS6TBOc0EPAvL8YJfkCJF/3ftLEsn7tgMR7Ve6/ALWdwyqop3V/6pRaMb3d:+PBTBCEPA93tEsn/AL4qoT6pRaMb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1984	884	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 884	1636	rundll32.exe	27
PID 1636 wrote to memory of 884	1636	rundll32.exe	27
PID 1636 wrote to memory of 884	1636	rundll32.exe	27
PID 1636 wrote to memory of 884	1636	rundll32.exe	27
PID 1636 wrote to memory of 884	1636	rundll32.exe	27
PID 1636 wrote to memory of 884	1636	rundll32.exe	27
PID 1636 wrote to memory of 884	1636	rundll32.exe	27
PID 884 wrote to memory of 1984	884	rundll32.exe	28
PID 884 wrote to memory of 1984	884	rundll32.exe	28
PID 884 wrote to memory of 1984	884	rundll32.exe	28
PID 884 wrote to memory of 1984	884	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\70194fa71d9d9c32fa9aedc3c386be901a4c1a22cc2f3951d3f370807411c462.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\70194fa71d9d9c32fa9aedc3c386be901a4c1a22cc2f3951d3f370807411c462.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 256
    3⤵
    - Program crash
    PID:1984

memory/884-55-0x0000000075E51000-0x0000000075E53000-memory.dmp

Filesize
8KB

Download
memory/884-56-0x0000000000100000-0x0000000000114000-memory.dmp

Filesize
80KB

Download
memory/884-57-0x0000000000180000-0x00000000001AD000-memory.dmp

Filesize
180KB

Download
memory/884-61-0x0000000000100000-0x0000000000114000-memory.dmp

Filesize
80KB

Download