599749b109f721f36f76b708e8582886b651e3ce0b855b51ebd5e857abeb6171

Analysis

max time kernel
39s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-10-2022 10:11

Target

599749b109f721f36f76b708e8582886b651e3ce0b855b51ebd5e857abeb6171.dll
Size

280KB
MD5

40c549486b4de232eb7ca4175981ddd6
SHA1

fd7c1f68aa0613b93139d1f0b9e109648412bf4c
SHA256

599749b109f721f36f76b708e8582886b651e3ce0b855b51ebd5e857abeb6171
SHA512

509608dfe313ca7fe24f7fd7270640338ef1138edbac57d7223ae27ab8a72092d330a665081ac0ac92b271ece6a40d710279f7f68e60e9f2177c3543a0011a08
SSDEEP

3072:4ZYU2rPrsfgVml2lwrsryNqDiXDuFPw7QRFwiCrSsTICt/egcnjhpijRphKQJosa:mY1rtwlUusr2qD6DLec1egSgUQJuAI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1364	1588	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 1588	1524	rundll32.exe	27
PID 1524 wrote to memory of 1588	1524	rundll32.exe	27
PID 1524 wrote to memory of 1588	1524	rundll32.exe	27
PID 1524 wrote to memory of 1588	1524	rundll32.exe	27
PID 1524 wrote to memory of 1588	1524	rundll32.exe	27
PID 1524 wrote to memory of 1588	1524	rundll32.exe	27
PID 1524 wrote to memory of 1588	1524	rundll32.exe	27
PID 1588 wrote to memory of 1364	1588	rundll32.exe	28
PID 1588 wrote to memory of 1364	1588	rundll32.exe	28
PID 1588 wrote to memory of 1364	1588	rundll32.exe	28
PID 1588 wrote to memory of 1364	1588	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\599749b109f721f36f76b708e8582886b651e3ce0b855b51ebd5e857abeb6171.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\599749b109f721f36f76b708e8582886b651e3ce0b855b51ebd5e857abeb6171.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 280
    3⤵
    - Program crash
    PID:1364

memory/1588-55-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1588-57-0x0000000075480000-0x00000000754C9000-memory.dmp

Filesize
292KB

Download
memory/1588-58-0x00000000000D0000-0x00000000000DF000-memory.dmp

Filesize
60KB

Download
memory/1588-59-0x0000000000670000-0x000000000067F000-memory.dmp

Filesize
60KB

Download