27563ae0c688c87ae5d97846d6f0365d54930d31f5ca644e0eafd86fc2366c5b

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 20:33

Target

27563ae0c688c87ae5d97846d6f0365d54930d31f5ca644e0eafd86fc2366c5b.dll
Size

148KB
MD5

7bff906d31ca1c2fb885a007e6b8b946
SHA1

6f71203969841ae43afe436f0091bfb68c27a7a0
SHA256

27563ae0c688c87ae5d97846d6f0365d54930d31f5ca644e0eafd86fc2366c5b
SHA512

b79a5f79fe2e5c4e42a3f5f7dc66e8e9bb84759da2c0eb9001d236aa85e9ac5be673b889dca2dec6eb6741d832f3537f8dc7fdfb40ebd4f16f25285f2c1cad72
SSDEEP

3072:kOHE31vHHuwv74gbNHcks6FENT/7JLuTMq0Bft4qfUHt4rw5zI:LklWwvlHjKbNuTMq0BlVfUHt4rQI

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\rundll32.exe.txt	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1932	280	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 280	536	rundll32.exe	27
PID 536 wrote to memory of 280	536	rundll32.exe	27
PID 536 wrote to memory of 280	536	rundll32.exe	27
PID 536 wrote to memory of 280	536	rundll32.exe	27
PID 536 wrote to memory of 280	536	rundll32.exe	27
PID 536 wrote to memory of 280	536	rundll32.exe	27
PID 536 wrote to memory of 280	536	rundll32.exe	27
PID 280 wrote to memory of 1932	280	rundll32.exe	28
PID 280 wrote to memory of 1932	280	rundll32.exe	28
PID 280 wrote to memory of 1932	280	rundll32.exe	28
PID 280 wrote to memory of 1932	280	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\27563ae0c688c87ae5d97846d6f0365d54930d31f5ca644e0eafd86fc2366c5b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\27563ae0c688c87ae5d97846d6f0365d54930d31f5ca644e0eafd86fc2366c5b.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:280
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 280 -s 236
    3⤵
    - Program crash
    PID:1932

memory/280-55-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download