1989a8569e42e684b1799ef3035f938b83c2f64d64718fe47ba540562cd0b3bb

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-10-2022 17:45

Target

396dba113699f4a82bb56d563ba5edb8.dll
Size

2.7MB
MD5

396dba113699f4a82bb56d563ba5edb8
SHA1

9afc7244e562f94308cb9daa15e28fa78265cf60
SHA256

1989a8569e42e684b1799ef3035f938b83c2f64d64718fe47ba540562cd0b3bb
SHA512

3ce5147451521367cca04c0c748d3f3f643e2f9a7ddf846f8d4122b50ce87abe8a7d634d4c3cfa3cb38a372caf7778cd01fddc630fa01661a9b19a5420419bdc
SSDEEP

49152:Jzl1rpbUrqvv0v2rQVt8nqwI7lOOYcp2ek:P1Kqvv07noI7lOOYc7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1676	1884	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 1884	780	rundll32.exe	28
PID 780 wrote to memory of 1884	780	rundll32.exe	28
PID 780 wrote to memory of 1884	780	rundll32.exe	28
PID 780 wrote to memory of 1884	780	rundll32.exe	28
PID 780 wrote to memory of 1884	780	rundll32.exe	28
PID 780 wrote to memory of 1884	780	rundll32.exe	28
PID 780 wrote to memory of 1884	780	rundll32.exe	28
PID 1884 wrote to memory of 1676	1884	rundll32.exe	29
PID 1884 wrote to memory of 1676	1884	rundll32.exe	29
PID 1884 wrote to memory of 1676	1884	rundll32.exe	29
PID 1884 wrote to memory of 1676	1884	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\396dba113699f4a82bb56d563ba5edb8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\396dba113699f4a82bb56d563ba5edb8.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 196
    3⤵
    - Program crash
    PID:1676

memory/1884-55-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download