22de52e3a116cef6814c07b03636afdb89d87664ed2fac2720b543ed10c6e772

Analysis

max time kernel
31s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-10-2022 04:32

Target

22de52e3a116cef6814c07b03636afdb89d87664ed2fac2720b543ed10c6e772.dll
Size

9KB
MD5

4d7130351f210773fd188ea2b72aab8c
SHA1

a33b07211325d702f18bfea8e3f57aa6e52530ef
SHA256

22de52e3a116cef6814c07b03636afdb89d87664ed2fac2720b543ed10c6e772
SHA512

7c0d4c1142dbe6183ca3cb2c62cb61a6747723e860941b7e864c8c17533cabb548cc27efddd42759ca33e8698904888135632a8e63e7a551661d5aa2c91863f2
SSDEEP

192:2No5kmXmEEnkITKoUBQIEtNvokhF5hDJtKfnv23qJthDNp0:A1mWEHI2oT7Nh9Dqv6qJtN70

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2036	1804	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 1804	1016	rundll32.exe	27
PID 1016 wrote to memory of 1804	1016	rundll32.exe	27
PID 1016 wrote to memory of 1804	1016	rundll32.exe	27
PID 1016 wrote to memory of 1804	1016	rundll32.exe	27
PID 1016 wrote to memory of 1804	1016	rundll32.exe	27
PID 1016 wrote to memory of 1804	1016	rundll32.exe	27
PID 1016 wrote to memory of 1804	1016	rundll32.exe	27
PID 1804 wrote to memory of 2036	1804	rundll32.exe	28
PID 1804 wrote to memory of 2036	1804	rundll32.exe	28
PID 1804 wrote to memory of 2036	1804	rundll32.exe	28
PID 1804 wrote to memory of 2036	1804	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\22de52e3a116cef6814c07b03636afdb89d87664ed2fac2720b543ed10c6e772.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\22de52e3a116cef6814c07b03636afdb89d87664ed2fac2720b543ed10c6e772.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 236
    3⤵
    - Program crash
    PID:2036

memory/1804-54-0x0000000000000000-mapping.dmp

Download
memory/1804-55-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download
memory/1804-56-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2036-57-0x0000000000000000-mapping.dmp

Download