568539b8776f6ac3e83c8fe967415c08b110ba3a62eaf5254e431d6bb7e31071

Analysis

max time kernel
41s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
18/10/2022, 18:43

Target

568539b8776f6ac3e83c8fe967415c08b110ba3a62eaf5254e431d6bb7e31071.dll
Size

512KB
MD5

c0d3a9519b99e5ba7b1f2ac0c8bc7ca2
SHA1

b982cdb132c06a101c96271f0783c43d658c1770
SHA256

568539b8776f6ac3e83c8fe967415c08b110ba3a62eaf5254e431d6bb7e31071
SHA512

0b869508d5ac6c0e423654f6a777413dad8fa82f2f77c54b88cc4508a88dea3876bd0072d302b0ec28cd67bb41f15f39a5e354287c2d379af8669b700672d73e
SSDEEP

6144:vslZ0VZXqjGbTtqqqqqqqqqqqqqqqqqqqqqqqqqSDukM7o:kunPN4E

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1764	1252	WerFault.exe	27

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1252	1760	rundll32.exe	27
PID 1760 wrote to memory of 1252	1760	rundll32.exe	27
PID 1760 wrote to memory of 1252	1760	rundll32.exe	27
PID 1760 wrote to memory of 1252	1760	rundll32.exe	27
PID 1760 wrote to memory of 1252	1760	rundll32.exe	27
PID 1760 wrote to memory of 1252	1760	rundll32.exe	27
PID 1760 wrote to memory of 1252	1760	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\568539b8776f6ac3e83c8fe967415c08b110ba3a62eaf5254e431d6bb7e31071.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\568539b8776f6ac3e83c8fe967415c08b110ba3a62eaf5254e431d6bb7e31071.dll,#1
  2⤵
  PID:1252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 268
    3⤵
    - Program crash
    PID:1764

memory/1252-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download