4a2d9062985debbff2494e158c66f26fe95d61a48900c47ff7a744d012e6f576

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-10-2022 17:47

Target

09069ada2901baf7354f44d097996698.dll
Size

2.7MB
MD5

09069ada2901baf7354f44d097996698
SHA1

32cef9ae388d149495d48d840377eb3d20803b48
SHA256

4a2d9062985debbff2494e158c66f26fe95d61a48900c47ff7a744d012e6f576
SHA512

c8ec99606e5d67f2297cdbb9b68a4c88fd373b361bea4edc0065fc8b26e58442bc0491c815cf85bb3bd81f1b5d5dab6cc0a4d88682697c404534f4a7c438f1f6
SSDEEP

49152:Jzl1rpbUrqvv0v2rQVt8nqwI7lOOYc52ek:P1Kqvv07noI7lOOYcL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
880	1428	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 1428	1044	rundll32.exe	27
PID 1044 wrote to memory of 1428	1044	rundll32.exe	27
PID 1044 wrote to memory of 1428	1044	rundll32.exe	27
PID 1044 wrote to memory of 1428	1044	rundll32.exe	27
PID 1044 wrote to memory of 1428	1044	rundll32.exe	27
PID 1044 wrote to memory of 1428	1044	rundll32.exe	27
PID 1044 wrote to memory of 1428	1044	rundll32.exe	27
PID 1428 wrote to memory of 880	1428	rundll32.exe	28
PID 1428 wrote to memory of 880	1428	rundll32.exe	28
PID 1428 wrote to memory of 880	1428	rundll32.exe	28
PID 1428 wrote to memory of 880	1428	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09069ada2901baf7354f44d097996698.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\09069ada2901baf7354f44d097996698.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 196
    3⤵
    - Program crash
    PID:880

memory/1428-55-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download