137b4250d35ac4d13ffc2843dcc315248c3127ac1280070fa5ab2b2355ab839d

Analysis

max time kernel
24s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12/10/2022, 13:40

Target

137b4250d35ac4d13ffc2843dcc315248c3127ac1280070fa5ab2b2355ab839d.dll
Size

339KB
MD5

6203707f752444c7b155ad28a04325a7
SHA1

6a0d7828cd0beccb71271c85ceedb0034d72b47a
SHA256

137b4250d35ac4d13ffc2843dcc315248c3127ac1280070fa5ab2b2355ab839d
SHA512

b76bcacbf4d06d740668fb82b16b9685b28dd682f049c0e541c82d58292ac151f3eea135863f1c56c586ea49e8dbfbcef12c90d4c72178765f8bb8bf34bf2677
SSDEEP

6144:fDauJce8O/hBMGRb+aA0yFi4b7RiMjRLVJpAJri87VTrrBzRHbFSMIT:fDPJz+p0gneJriq/BZIT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1388	304	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 304	1072	rundll32.exe	27
PID 1072 wrote to memory of 304	1072	rundll32.exe	27
PID 1072 wrote to memory of 304	1072	rundll32.exe	27
PID 1072 wrote to memory of 304	1072	rundll32.exe	27
PID 1072 wrote to memory of 304	1072	rundll32.exe	27
PID 1072 wrote to memory of 304	1072	rundll32.exe	27
PID 1072 wrote to memory of 304	1072	rundll32.exe	27
PID 304 wrote to memory of 1388	304	rundll32.exe	28
PID 304 wrote to memory of 1388	304	rundll32.exe	28
PID 304 wrote to memory of 1388	304	rundll32.exe	28
PID 304 wrote to memory of 1388	304	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\137b4250d35ac4d13ffc2843dcc315248c3127ac1280070fa5ab2b2355ab839d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\137b4250d35ac4d13ffc2843dcc315248c3127ac1280070fa5ab2b2355ab839d.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 304 -s 256
    3⤵
    - Program crash
    PID:1388

memory/304-55-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/304-56-0x00000000001C0000-0x0000000000204000-memory.dmp

Filesize
272KB

Download
memory/304-57-0x0000000000260000-0x00000000002B8000-memory.dmp

Filesize
352KB

Download
memory/304-62-0x00000000001C0000-0x0000000000204000-memory.dmp

Filesize
272KB

Download