8c3089133607bfd2a73d5f06ea60b7aca0989bedfd7a503e0beda16249a9e83d

Resubmissions

03-10-2022 18:11

26-09-2022 21:49

max time kernel
37s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 18:11

Target

lqDwAhoXOlNwLd.dll
Size

2.8MB
MD5

facf173726f6b3c0dfc6bff5b223e67b
SHA1

d26afc80fb12850d46683b8c217e07dd96277963
SHA256

07240bc14c34f1bcac94a19e0d5e6331d98717a65b76f7a106216a41de782a8c
SHA512

230800d537c32f8329dca1e54fc7c73cc35c809f6eb4f169dc79f4d91c155665f159b5cfc203c584970807b95c5975323690288b703c1f2c7136f4b6e176e3ed
SSDEEP

49152:cUV3v7mzyveqNwoqmTL93qSsgMObQGkCxnkaugjSo51OZ+BCPe6UNb/ed9rg2UsL:bmehNdqiL93qs3bZkCxnkTgjSovh6+bG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1536	1388	WerFault.exe	25

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lqDwAhoXOlNwLd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1388 -s 84
  2⤵
  - Program crash
  PID:1536