1d740905dbbf6398ff6c3c434b4ea80831f48311c18858a39bd47085e69d3995

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
17-10-2022 02:49

Target

1d740905dbbf6398ff6c3c434b4ea80831f48311c18858a39bd47085e69d3995.dll
Size

1.3MB
MD5

21387aa4631fbd5354f064b17abda3f5
SHA1

ed5ea63563e9a70281c8165fc5b5d28b13d6524c
SHA256

1d740905dbbf6398ff6c3c434b4ea80831f48311c18858a39bd47085e69d3995
SHA512

8e746feaaf1915a40f85b36bacac7a093e0c88a977a9554b698fd396d86c1bc04a7eed7a11198deac72073a957e2409586bfacd81bed0a4d78b0c2013307e6a2
SSDEEP

24576:pMiKhbFh1NHmvBQBx8pbajyNLAqRAAaJsLhaJctuHREqYOvxVAjZp5V:Spf8pbrNEqRFosL06YmjZp5V

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1380	904	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 904	1528	rundll32.exe	27
PID 1528 wrote to memory of 904	1528	rundll32.exe	27
PID 1528 wrote to memory of 904	1528	rundll32.exe	27
PID 1528 wrote to memory of 904	1528	rundll32.exe	27
PID 1528 wrote to memory of 904	1528	rundll32.exe	27
PID 1528 wrote to memory of 904	1528	rundll32.exe	27
PID 1528 wrote to memory of 904	1528	rundll32.exe	27
PID 904 wrote to memory of 1380	904	rundll32.exe	28
PID 904 wrote to memory of 1380	904	rundll32.exe	28
PID 904 wrote to memory of 1380	904	rundll32.exe	28
PID 904 wrote to memory of 1380	904	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d740905dbbf6398ff6c3c434b4ea80831f48311c18858a39bd47085e69d3995.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d740905dbbf6398ff6c3c434b4ea80831f48311c18858a39bd47085e69d3995.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 256
    3⤵
    - Program crash
    PID:1380

memory/904-54-0x0000000000000000-mapping.dmp

Download
memory/904-55-0x0000000075021000-0x0000000075023000-memory.dmp

Filesize
8KB

Download
memory/904-56-0x0000000000480000-0x00000000005D4000-memory.dmp

Filesize
1.3MB

Download
memory/1380-57-0x0000000000000000-mapping.dmp

Download