5116a033729324ababf3d8b984b9bd308025e65c243c536218750ea0ae1e779d

Analysis

max time kernel
19s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 11:58

Target

5116a033729324ababf3d8b984b9bd308025e65c243c536218750ea0ae1e779d.dll
Size

732KB
MD5

619eb334a43c291cdd1e957d2d6b8b70
SHA1

fddc6dcc1dbc812e0b9bd580021a82270f35b671
SHA256

5116a033729324ababf3d8b984b9bd308025e65c243c536218750ea0ae1e779d
SHA512

4b1ec595694d992b2edfb612bd0eb98273f677ad7ba39cf2ba023a20b2d87633108739ae26ea10f8d13791177617eb3aae7969370cd27398c50102e6fe72ba1c
SSDEEP

12288:BM4+65nP54pVgWeNdeWk86PxSgs3nly1gJlvaTOpEI71mAHvqhTYxeQAy2:BB+EnKpVgWerWDAT3lyG705619CTETA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1784	908	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 908	1572	rundll32.exe	28
PID 1572 wrote to memory of 908	1572	rundll32.exe	28
PID 1572 wrote to memory of 908	1572	rundll32.exe	28
PID 1572 wrote to memory of 908	1572	rundll32.exe	28
PID 1572 wrote to memory of 908	1572	rundll32.exe	28
PID 1572 wrote to memory of 908	1572	rundll32.exe	28
PID 1572 wrote to memory of 908	1572	rundll32.exe	28
PID 908 wrote to memory of 1784	908	rundll32.exe	29
PID 908 wrote to memory of 1784	908	rundll32.exe	29
PID 908 wrote to memory of 1784	908	rundll32.exe	29
PID 908 wrote to memory of 1784	908	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5116a033729324ababf3d8b984b9bd308025e65c243c536218750ea0ae1e779d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5116a033729324ababf3d8b984b9bd308025e65c243c536218750ea0ae1e779d.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 224
    3⤵
    - Program crash
    PID:1784

memory/908-55-0x00000000758C1000-0x00000000758C3000-memory.dmp

Filesize
8KB

Download
memory/908-56-0x0000000000760000-0x000000000081C000-memory.dmp

Filesize
752KB

Download