6734e708c6beaf74eeca069129144d5fe7aec8b9a3ac3154a1e5df6647782f9b

Analysis

max time kernel
40s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15/10/2022, 04:33

Target

CADe_SIMUdqfz电路图仿真软件/CADe_SIMUdqfz/MSVCRTD.dll
Size

156KB
MD5

36281bb9a843fcfc4edf98b036c86152
SHA1

aa0bb1bfe2811c3343c6bdc70b27c9d59490ee2c
SHA256

97c22e2f2f6ec8efb43be2ff893cafd2134b4df994c4b81d5f8941efd7d87a1d
SHA512

d150970e161afe56790c2dd11a63ff505487552e1af9286a502f0af66d65e62cfc8eab6871226616a876eae0373047a65b49011e21c45996e6f30e2c41be1a19
SSDEEP

3072:8JtSK78ev6xXxxHBp+js0F74v/XT69vyBya1tFGmB7z/oNrtrkFk3MWiFhPNSIR3:gSs8TBpLeRcv/qyBy2GmCtr8k3MWiFJW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2004	1360	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 1360	1512	rundll32.exe	27
PID 1512 wrote to memory of 1360	1512	rundll32.exe	27
PID 1512 wrote to memory of 1360	1512	rundll32.exe	27
PID 1512 wrote to memory of 1360	1512	rundll32.exe	27
PID 1512 wrote to memory of 1360	1512	rundll32.exe	27
PID 1512 wrote to memory of 1360	1512	rundll32.exe	27
PID 1512 wrote to memory of 1360	1512	rundll32.exe	27
PID 1360 wrote to memory of 2004	1360	rundll32.exe	28
PID 1360 wrote to memory of 2004	1360	rundll32.exe	28
PID 1360 wrote to memory of 2004	1360	rundll32.exe	28
PID 1360 wrote to memory of 2004	1360	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CADe_SIMUdqfz电路图仿真软件\CADe_SIMUdqfz\MSVCRTD.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CADe_SIMUdqfz电路图仿真软件\CADe_SIMUdqfz\MSVCRTD.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 228
    3⤵
    - Program crash
    PID:2004

memory/1360-55-0x00000000756A1000-0x00000000756A3000-memory.dmp

Filesize
8KB

Download
memory/1360-56-0x0000000010200000-0x0000000010263000-memory.dmp

Filesize
396KB

Download