d57de1823c65c7ad1c272e28984fc89582eb47bfb6c9854173dfd19ee9fd4bd0

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 08:49

Target

d57de1823c65c7ad1c272e28984fc89582eb47bfb6c9854173dfd19ee9fd4bd0.dll
Size

399KB
MD5

5c541a7bd8e2622d0a9e6246b93d95b2
SHA1

72f9dd8c2491f5f34c29e7235fe75ab9c8504610
SHA256

d57de1823c65c7ad1c272e28984fc89582eb47bfb6c9854173dfd19ee9fd4bd0
SHA512

0c4dadca8f1985f2b8acaed757fc00e93abf5cecadc8f6ad8c290c3fd81ebc07286fbd909d3953c478cd1d9568d65a9f66cedf4b3e62a060051ee3a13105dbdc
SSDEEP

6144:v/57WUNz+xKF1sjcVDNmcCUWHKOW/vNCW3e0dZfFgCZTdsmnElkZKrt21R:v/5CUNyzjc9FW9m1dTdxGmnOkqtu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
892	1852	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1852	2036	rundll32.exe	28
PID 2036 wrote to memory of 1852	2036	rundll32.exe	28
PID 2036 wrote to memory of 1852	2036	rundll32.exe	28
PID 2036 wrote to memory of 1852	2036	rundll32.exe	28
PID 2036 wrote to memory of 1852	2036	rundll32.exe	28
PID 2036 wrote to memory of 1852	2036	rundll32.exe	28
PID 2036 wrote to memory of 1852	2036	rundll32.exe	28
PID 1852 wrote to memory of 892	1852	rundll32.exe	29
PID 1852 wrote to memory of 892	1852	rundll32.exe	29
PID 1852 wrote to memory of 892	1852	rundll32.exe	29
PID 1852 wrote to memory of 892	1852	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d57de1823c65c7ad1c272e28984fc89582eb47bfb6c9854173dfd19ee9fd4bd0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d57de1823c65c7ad1c272e28984fc89582eb47bfb6c9854173dfd19ee9fd4bd0.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 296
    3⤵
    - Program crash
    PID:892

memory/1852-55-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download
memory/1852-58-0x00000000002B0000-0x00000000002FB000-memory.dmp

Filesize
300KB

Download
memory/1852-57-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download