4882da2347294c3b4fb9f60b87a78b4ad15ec950ee2b9c82b30ab5acdb2db9a4

Analysis

max time kernel
46s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
14-10-2022 05:58

Target

53c6a285218e7b8a6f8b75a8ce6eb97d.dll
Size

2.7MB
MD5

53c6a285218e7b8a6f8b75a8ce6eb97d
SHA1

2fe41b5ca48147d105276b74c75f06c9fae4e0d7
SHA256

4882da2347294c3b4fb9f60b87a78b4ad15ec950ee2b9c82b30ab5acdb2db9a4
SHA512

294fd9085237e119283fad60ff409cc49a4fc189ce4becbc63e4ad4a9cac07528701e084320bd1db51b17a219c52b218dfcc5bda24df742fdbb89f35328c8222
SSDEEP

49152:Jzl1rpbUrqvv0v2rQVt8nqwI7lOOYc/2ek:P1Kqvv07noI7lOOYcJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
840	1344	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1344 wrote to memory of 840	1344	rundll32.exe	28
PID 1344 wrote to memory of 840	1344	rundll32.exe	28
PID 1344 wrote to memory of 840	1344	rundll32.exe	28
PID 1344 wrote to memory of 840	1344	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\53c6a285218e7b8a6f8b75a8ce6eb97d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\53c6a285218e7b8a6f8b75a8ce6eb97d.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 196
    3⤵
    - Program crash
    PID:840

memory/1344-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download