cd2a129d71754a6d149a775f4872ee86019828b3569d8cb4a30fed15ce6f1ee0

Analysis

max time kernel
28s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 04:51

Target

cd2a129d71754a6d149a775f4872ee86019828b3569d8cb4a30fed15ce6f1ee0.dll
Size

57KB
MD5

663f4db4ce52c4b0bcfb05dd60f84ae0
SHA1

1dc089e77608675368ba77dd8102a45a543d0cab
SHA256

cd2a129d71754a6d149a775f4872ee86019828b3569d8cb4a30fed15ce6f1ee0
SHA512

2976bc60e935270483328cdefb7eed4130d536a2149e34b86439a8d8930da77e971ec58dfc05485066478819d82d64971ca0f5e07b2b47264cf88b77f0076b72
SSDEEP

768:qcxTSIVd3L2LQF10dwJVnO0NkYEmcxTCX:qcxTSaYA0dAR1EmcxT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
948	1628	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1628	1632	rundll32.exe	27
PID 1632 wrote to memory of 1628	1632	rundll32.exe	27
PID 1632 wrote to memory of 1628	1632	rundll32.exe	27
PID 1632 wrote to memory of 1628	1632	rundll32.exe	27
PID 1632 wrote to memory of 1628	1632	rundll32.exe	27
PID 1632 wrote to memory of 1628	1632	rundll32.exe	27
PID 1632 wrote to memory of 1628	1632	rundll32.exe	27
PID 1628 wrote to memory of 948	1628	rundll32.exe	28
PID 1628 wrote to memory of 948	1628	rundll32.exe	28
PID 1628 wrote to memory of 948	1628	rundll32.exe	28
PID 1628 wrote to memory of 948	1628	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cd2a129d71754a6d149a775f4872ee86019828b3569d8cb4a30fed15ce6f1ee0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cd2a129d71754a6d149a775f4872ee86019828b3569d8cb4a30fed15ce6f1ee0.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 256
    3⤵
    - Program crash
    PID:948

memory/1628-55-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/1628-57-0x0000000020000000-0x0000000020014000-memory.dmp

Filesize
80KB

Download