b8490732ccb34fdd76910ee15aa3eced95ef445f2ab287d45181f98f44742df1

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-10-2022 17:46

Target

800619c7ef9baa08d8b9166afc95ce75.dll
Size

2.7MB
MD5

800619c7ef9baa08d8b9166afc95ce75
SHA1

e97b1c9da42e67666a46ac930187695d3987d1a5
SHA256

b8490732ccb34fdd76910ee15aa3eced95ef445f2ab287d45181f98f44742df1
SHA512

abe650bc340f6c1dc60fbc0296c0678cefa9249cbeb2b315ea02565d78c39db3c31679190fe1012e70a7a992cc47fc6053926b928c945b6c9d50f24deb4aa61f
SSDEEP

49152:Jzl1rpbUrqvv0v2rQVt8nqwI7lOOYcS2ek:P1Kqvv07noI7lOOYcW

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2040 1176 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2040	1176	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1336 wrote to memory of 1176	1336	rundll32.exe	rundll32.exe
PID 1336 wrote to memory of 1176	1336	rundll32.exe	rundll32.exe
PID 1336 wrote to memory of 1176	1336	rundll32.exe	rundll32.exe
PID 1336 wrote to memory of 1176	1336	rundll32.exe	rundll32.exe
PID 1336 wrote to memory of 1176	1336	rundll32.exe	rundll32.exe
PID 1336 wrote to memory of 1176	1336	rundll32.exe	rundll32.exe
PID 1336 wrote to memory of 1176	1336	rundll32.exe	rundll32.exe
PID 1176 wrote to memory of 2040	1176	rundll32.exe	WerFault.exe
PID 1176 wrote to memory of 2040	1176	rundll32.exe	WerFault.exe
PID 1176 wrote to memory of 2040	1176	rundll32.exe	WerFault.exe
PID 1176 wrote to memory of 2040	1176	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\800619c7ef9baa08d8b9166afc95ce75.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\800619c7ef9baa08d8b9166afc95ce75.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1176 -s 196
    3⤵
    - Program crash
    PID:2040

memory/1176-54-0x0000000000000000-mapping.dmp

Download
memory/1176-55-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/2040-56-0x0000000000000000-mapping.dmp

Download