f63786523bf83a9c8979951bf5e8d71ff0b92f05411ba975bfecdbdc7d221751

Analysis

max time kernel
424s
max time network
427s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-10-2022 05:22

Target

3a1c350e3fcd95acc2c6d1281a4e6c81a75a9678f4e4c55a417e011cd1400796_dump_0x20030000.dll
Size

44KB
MD5

544bd9a9c36403aba36d5b51f4a0064a
SHA1

c388e2d83943a097271b4f720007ff61bbecb617
SHA256

f63786523bf83a9c8979951bf5e8d71ff0b92f05411ba975bfecdbdc7d221751
SHA512

f2ad4b5159899ec69167fc01032b726b925e75714d494162cff876f2eb86145748dae4c7b76ba69359dd618c05aee1363d30e73208af2046f3e3768a0915f3e6
SSDEEP

768:GbDYc+9e+oRuNuTZGj+UNgTJb5K5APogYWED0:Gb0GQNuMj+UE5K5rWED

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1092	2016	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2016	1672	rundll32.exe	27
PID 1672 wrote to memory of 2016	1672	rundll32.exe	27
PID 1672 wrote to memory of 2016	1672	rundll32.exe	27
PID 1672 wrote to memory of 2016	1672	rundll32.exe	27
PID 1672 wrote to memory of 2016	1672	rundll32.exe	27
PID 1672 wrote to memory of 2016	1672	rundll32.exe	27
PID 1672 wrote to memory of 2016	1672	rundll32.exe	27
PID 2016 wrote to memory of 1092	2016	rundll32.exe	28
PID 2016 wrote to memory of 1092	2016	rundll32.exe	28
PID 2016 wrote to memory of 1092	2016	rundll32.exe	28
PID 2016 wrote to memory of 1092	2016	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a1c350e3fcd95acc2c6d1281a4e6c81a75a9678f4e4c55a417e011cd1400796_dump_0x20030000.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a1c350e3fcd95acc2c6d1281a4e6c81a75a9678f4e4c55a417e011cd1400796_dump_0x20030000.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 196
    3⤵
    - Program crash
    PID:1092

memory/2016-55-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download