5158105d48028da7c6df1e28bbcadc2a0161fc13a2eb15580228c4b61d419ddf

Analysis

max time kernel
36s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 21:28

Target

5158105d48028da7c6df1e28bbcadc2a0161fc13a2eb15580228c4b61d419ddf.dll
Size

87KB
MD5

6afed1f4682e0c2e2d898a487ea43040
SHA1

635fb1d55b556925f03186b68e48040dbf75da87
SHA256

5158105d48028da7c6df1e28bbcadc2a0161fc13a2eb15580228c4b61d419ddf
SHA512

8b05e57dd4b33e35820a896934044081df17147a0f9b2e3e6f085a711db549633055c855e5aa9c7d4eb737220bd9ae5b4a0f4be34c0502809865bf1e8c60f329
SSDEEP

1536:IPprcK1iu06y+h0pEx2vhrAKjH4fT2Yi+/MaLZsIe76T:WprcKoC2BjH0TKuoGT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1880	1644	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 1644	744	rundll32.exe	28
PID 744 wrote to memory of 1644	744	rundll32.exe	28
PID 744 wrote to memory of 1644	744	rundll32.exe	28
PID 744 wrote to memory of 1644	744	rundll32.exe	28
PID 744 wrote to memory of 1644	744	rundll32.exe	28
PID 744 wrote to memory of 1644	744	rundll32.exe	28
PID 744 wrote to memory of 1644	744	rundll32.exe	28
PID 1644 wrote to memory of 1880	1644	rundll32.exe	29
PID 1644 wrote to memory of 1880	1644	rundll32.exe	29
PID 1644 wrote to memory of 1880	1644	rundll32.exe	29
PID 1644 wrote to memory of 1880	1644	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5158105d48028da7c6df1e28bbcadc2a0161fc13a2eb15580228c4b61d419ddf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5158105d48028da7c6df1e28bbcadc2a0161fc13a2eb15580228c4b61d419ddf.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 240
    3⤵
    - Program crash
    PID:1880

memory/1644-55-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download
memory/1644-58-0x0000000000170000-0x000000000017F000-memory.dmp

Filesize
60KB

Download
memory/1644-57-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/1644-59-0x0000000000180000-0x000000000018F000-memory.dmp

Filesize
60KB

Download