f017acffb6f7d3f00f81c120f188904c084f21f694c36a56b274721e89cc9354

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 15:51

Target

f017acffb6f7d3f00f81c120f188904c084f21f694c36a56b274721e89cc9354.dll
Size

9KB
MD5

6db1a3b94dbde71c085863e3a7918f68
SHA1

cf3b7c8310a17bc92502d90578c0fda4c8c296a5
SHA256

f017acffb6f7d3f00f81c120f188904c084f21f694c36a56b274721e89cc9354
SHA512

48fd689acc4f81a6d271219ba28328caf68ca936f11b9477d09bd3cf695c7a0c4685d29ba36128c6035a6f2eafdfc3cb5c75963ef2b7c4ef17d4a2d5926ea80a
SSDEEP

192:mNo5kmXmEEnkITKoUBQIEtNvokhF5hDJtKfnv23qJthDNp0:Q1mWEHI2oT7Nh9Dqv6qJtN70

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
860	1120	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26
PID 1120 wrote to memory of 860	1120	rundll32.exe	27
PID 1120 wrote to memory of 860	1120	rundll32.exe	27
PID 1120 wrote to memory of 860	1120	rundll32.exe	27
PID 1120 wrote to memory of 860	1120	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f017acffb6f7d3f00f81c120f188904c084f21f694c36a56b274721e89cc9354.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f017acffb6f7d3f00f81c120f188904c084f21f694c36a56b274721e89cc9354.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 236
    3⤵
    - Program crash
    PID:860

memory/1120-55-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download
memory/1120-57-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download