f4b14cecd5354429724883eb0d84ff618147eb8598bb0798efdbe747143da292

Analysis

max time kernel
25s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 01:30

Target

f4b14cecd5354429724883eb0d84ff618147eb8598bb0798efdbe747143da292.dll
Size

500KB
MD5

5831bb1804186234eac4df822b0d6630
SHA1

9345d68d4d0fe9f50162e0989c4541186c4a7e98
SHA256

f4b14cecd5354429724883eb0d84ff618147eb8598bb0798efdbe747143da292
SHA512

ebd576794fa3603967fdfd76e40c004a2951d239f799a361c5d72611719ae46ecc8bc4d44554be44ffe03bd752fc38e0a85aaa99adc6e225337bb78ed28506b8
SSDEEP

12288:PLrgV2bhQxaZRQ1kJASqNQ7H/KL34OfJbDWN:DA2b2oZkkJAJu7fWJb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
956	804	WerFault.exe	19

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 956	804	rundll32.exe	28
PID 804 wrote to memory of 956	804	rundll32.exe	28
PID 804 wrote to memory of 956	804	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4b14cecd5354429724883eb0d84ff618147eb8598bb0798efdbe747143da292.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:804
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 804 -s 96
  2⤵
  - Program crash
  PID:956