f5d7e68787bf6fc317f7d3af3e6a6a2a1683dd573ab67a5c059afed9868a33b7

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 18:33

Target

f5d7e68787bf6fc317f7d3af3e6a6a2a1683dd573ab67a5c059afed9868a33b7.dll
Size

860KB
MD5

93f7bd2fffecb2ad25858e49415e7bc9
SHA1

b62cbabb47aaedf4aff42dc64f73a50b2f55bea3
SHA256

f5d7e68787bf6fc317f7d3af3e6a6a2a1683dd573ab67a5c059afed9868a33b7
SHA512

9cf02d9a68e5635566ddf5af396b2bdd20f7d1291eb07b59b312389d6cd5a91ded4be5539a098dcbb3fc51e63f5ee6db6c562f11b405c67867c036a0c72d7204
SSDEEP

12288:XbRjdQWRdOaMj+JR3Y57H3Rz0smutNjRua4Wr:Xb9lRdOLjIRK7XdLNjR8Wr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
936	1744	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1744	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27
PID 1744 wrote to memory of 936	1744	rundll32.exe	28
PID 1744 wrote to memory of 936	1744	rundll32.exe	28
PID 1744 wrote to memory of 936	1744	rundll32.exe	28
PID 1744 wrote to memory of 936	1744	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f5d7e68787bf6fc317f7d3af3e6a6a2a1683dd573ab67a5c059afed9868a33b7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f5d7e68787bf6fc317f7d3af3e6a6a2a1683dd573ab67a5c059afed9868a33b7.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 316
    3⤵
    - Program crash
    PID:936

memory/1744-55-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download