4ef5350b8a744df46f2dd29350a9b44cb719a09fa55d4668af7f9eb5ab592292

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 21:58

Target

4ef5350b8a744df46f2dd29350a9b44cb719a09fa55d4668af7f9eb5ab592292.dll
Size

11KB
MD5

29a0fef43c0985c7f5c4ec4fee9ad2f9
SHA1

a9957dd484fafb3df973f6addd1203562566bf07
SHA256

4ef5350b8a744df46f2dd29350a9b44cb719a09fa55d4668af7f9eb5ab592292
SHA512

e7690ae86651a1270d3f15e63e2a8cd5ddee81155551da21752cd1eb0e445d9e13756a78f96f136f744852bde7988a95f826c8df4ff84130d9d085a2ba0fba0a
SSDEEP

192:NT0Gi3EhXnyieSTT9HH2Ai4s4Ni3X+cq1NfY8:qBEhXnyiHTT9HHNns4Nuu4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
544	1160	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1160	1712	rundll32.exe	27
PID 1712 wrote to memory of 1160	1712	rundll32.exe	27
PID 1712 wrote to memory of 1160	1712	rundll32.exe	27
PID 1712 wrote to memory of 1160	1712	rundll32.exe	27
PID 1712 wrote to memory of 1160	1712	rundll32.exe	27
PID 1712 wrote to memory of 1160	1712	rundll32.exe	27
PID 1712 wrote to memory of 1160	1712	rundll32.exe	27
PID 1160 wrote to memory of 544	1160	rundll32.exe	29
PID 1160 wrote to memory of 544	1160	rundll32.exe	29
PID 1160 wrote to memory of 544	1160	rundll32.exe	29
PID 1160 wrote to memory of 544	1160	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ef5350b8a744df46f2dd29350a9b44cb719a09fa55d4668af7f9eb5ab592292.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ef5350b8a744df46f2dd29350a9b44cb719a09fa55d4668af7f9eb5ab592292.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 220
    3⤵
    - Program crash
    PID:544

memory/1160-55-0x00000000765B1000-0x00000000765B3000-memory.dmp

Filesize
8KB

Download