51361c0c166b8d11231c7fd03be31473248aff454092df5ee0101690deb02216

Analysis

max time kernel
7s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 07:47

Target

51361c0c166b8d11231c7fd03be31473248aff454092df5ee0101690deb02216.dll
Size

163KB
MD5

69bd05fdcc804e6c51692a5f01b17687
SHA1

77e94b35e46748ee47fa988fe997d93558d9a2f8
SHA256

51361c0c166b8d11231c7fd03be31473248aff454092df5ee0101690deb02216
SHA512

a1eb4c007378275b8ef1459fc6fb8d52c907b67359720475573c0fa67c771669343462bd9806c6a8664b6262e7da4db4d977ce62adc787293edd066bcd7fed07
SSDEEP

3072:qIHjWh4h00eVCic5Ls9XRnKFWpkBWcQ3fvq6w4tUv7nFX:rHjWhnVVKsL6nWc57nF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1768	1668	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1668	2032	rundll32.exe	27
PID 2032 wrote to memory of 1668	2032	rundll32.exe	27
PID 2032 wrote to memory of 1668	2032	rundll32.exe	27
PID 2032 wrote to memory of 1668	2032	rundll32.exe	27
PID 2032 wrote to memory of 1668	2032	rundll32.exe	27
PID 2032 wrote to memory of 1668	2032	rundll32.exe	27
PID 2032 wrote to memory of 1668	2032	rundll32.exe	27
PID 1668 wrote to memory of 1768	1668	rundll32.exe	28
PID 1668 wrote to memory of 1768	1668	rundll32.exe	28
PID 1668 wrote to memory of 1768	1668	rundll32.exe	28
PID 1668 wrote to memory of 1768	1668	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\51361c0c166b8d11231c7fd03be31473248aff454092df5ee0101690deb02216.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\51361c0c166b8d11231c7fd03be31473248aff454092df5ee0101690deb02216.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 256
    3⤵
    - Program crash
    PID:1768

memory/1668-55-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download
memory/1668-56-0x00000000003C0000-0x00000000003EB000-memory.dmp

Filesize
172KB

Download
memory/1668-61-0x0000000000150000-0x0000000000164000-memory.dmp

Filesize
80KB

Download