85ee355b659a73fb1712d45de29267767fc0989eaf15e6db2e3061fa946bf0e1

Analysis

max time kernel
46s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
21-10-2022 05:35

Target

85ee355b659a73fb1712d45de29267767fc0989eaf15e6db2e3061fa946bf0e1.dll
Size

144KB
MD5

592e2b067f93aea0a7b12ae4dcfab22d
SHA1

14c6872e4155459ea3d506864f4a0dbbd8a15aa8
SHA256

85ee355b659a73fb1712d45de29267767fc0989eaf15e6db2e3061fa946bf0e1
SHA512

ad4cc0a090ed9e30d99d03fbf65464dc28b90f69ae3c46c482bbeb200e96bcf9a8a60291b3c7b27582ea53aa52c1cb86f7aa583aedcd8b01f18ad103d311e2e1
SSDEEP

3072:5YZX/bz/SBkux79qk9CVooH9vMvgIiCNORe8rsZe5bf:5oSf7hyZZMTiUmM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1692	1356	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 1356	1308	rundll32.exe	27
PID 1308 wrote to memory of 1356	1308	rundll32.exe	27
PID 1308 wrote to memory of 1356	1308	rundll32.exe	27
PID 1308 wrote to memory of 1356	1308	rundll32.exe	27
PID 1308 wrote to memory of 1356	1308	rundll32.exe	27
PID 1308 wrote to memory of 1356	1308	rundll32.exe	27
PID 1308 wrote to memory of 1356	1308	rundll32.exe	27
PID 1356 wrote to memory of 1692	1356	rundll32.exe	28
PID 1356 wrote to memory of 1692	1356	rundll32.exe	28
PID 1356 wrote to memory of 1692	1356	rundll32.exe	28
PID 1356 wrote to memory of 1692	1356	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\85ee355b659a73fb1712d45de29267767fc0989eaf15e6db2e3061fa946bf0e1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\85ee355b659a73fb1712d45de29267767fc0989eaf15e6db2e3061fa946bf0e1.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 228
    3⤵
    - Program crash
    PID:1692

memory/1356-55-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/1356-56-0x0000000000160000-0x0000000000173000-memory.dmp

Filesize
76KB

Download
memory/1356-57-0x00000000002D0000-0x00000000002F7000-memory.dmp

Filesize
156KB

Download
memory/1356-62-0x0000000000160000-0x0000000000173000-memory.dmp

Filesize
76KB

Download
memory/1356-63-0x0000000000160000-0x0000000000173000-memory.dmp

Filesize
76KB

Download