4a36a1af9e16ea478ee8901de696d359362cd5a1debecdd7211659113db85328

Analysis

max time kernel
26s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14-10-2022 05:57

Target

45d5d6fe1ce8d8ebac7a35f323221e83.dll
Size

2.7MB
MD5

45d5d6fe1ce8d8ebac7a35f323221e83
SHA1

f26aef3ee98afef8e1228bd05e0db1cff933b5f0
SHA256

4a36a1af9e16ea478ee8901de696d359362cd5a1debecdd7211659113db85328
SHA512

4e5884185c2631789230f3dc3a4fa52bd0141b320ec514c83866a1c492371c7b8b77a44822bfcf809420509799ccbe98aba2a2947efcb80096c030e4a64aba92
SSDEEP

49152:Jzl1rpbUrqvv0v2rQVt8nqwI7lOOYcH2ek:P1Kqvv07noI7lOOYcR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
268	1056	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 1056	1952	rundll32.exe	28
PID 1952 wrote to memory of 1056	1952	rundll32.exe	28
PID 1952 wrote to memory of 1056	1952	rundll32.exe	28
PID 1952 wrote to memory of 1056	1952	rundll32.exe	28
PID 1952 wrote to memory of 1056	1952	rundll32.exe	28
PID 1952 wrote to memory of 1056	1952	rundll32.exe	28
PID 1952 wrote to memory of 1056	1952	rundll32.exe	28
PID 1056 wrote to memory of 268	1056	rundll32.exe	29
PID 1056 wrote to memory of 268	1056	rundll32.exe	29
PID 1056 wrote to memory of 268	1056	rundll32.exe	29
PID 1056 wrote to memory of 268	1056	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\45d5d6fe1ce8d8ebac7a35f323221e83.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\45d5d6fe1ce8d8ebac7a35f323221e83.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 196
    3⤵
    - Program crash
    PID:268

memory/1056-55-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download