c248ee5705be99cfca4908edfed658d5de8c4679e142ddc3e0ff4667ebd0d1de

Analysis

max time kernel
36s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14/10/2022, 09:28

Target

c248ee5705be99cfca4908edfed658d5de8c4679e142ddc3e0ff4667ebd0d1de.dll
Size

402KB
MD5

663520f359b85e69ee8e72fb30d97040
SHA1

46c41e200510354d756294b7913461cb6aacf772
SHA256

c248ee5705be99cfca4908edfed658d5de8c4679e142ddc3e0ff4667ebd0d1de
SHA512

a858313cc121a58d1315efc9504061c3375252efad1dd3ef06e80b4599ca0692b5091c3a150a9f706774b01039617cb8742d052bbcd90a7e7f4718fe18cf686c
SSDEEP

12288:uyt+xo/6NrSaCrVu4W1dTdxGmnOdc6aEK:uyn+eYdTH7kcZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1992	1940	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1940	900	rundll32.exe	27
PID 900 wrote to memory of 1940	900	rundll32.exe	27
PID 900 wrote to memory of 1940	900	rundll32.exe	27
PID 900 wrote to memory of 1940	900	rundll32.exe	27
PID 900 wrote to memory of 1940	900	rundll32.exe	27
PID 900 wrote to memory of 1940	900	rundll32.exe	27
PID 900 wrote to memory of 1940	900	rundll32.exe	27
PID 1940 wrote to memory of 1992	1940	rundll32.exe	28
PID 1940 wrote to memory of 1992	1940	rundll32.exe	28
PID 1940 wrote to memory of 1992	1940	rundll32.exe	28
PID 1940 wrote to memory of 1992	1940	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c248ee5705be99cfca4908edfed658d5de8c4679e142ddc3e0ff4667ebd0d1de.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c248ee5705be99cfca4908edfed658d5de8c4679e142ddc3e0ff4667ebd0d1de.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 296
    3⤵
    - Program crash
    PID:1992

memory/1940-55-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download
memory/1940-57-0x0000000000170000-0x00000000001F0000-memory.dmp

Filesize
512KB

Download
memory/1940-58-0x0000000000350000-0x000000000039B000-memory.dmp

Filesize
300KB

Download