47b26e0172dff4ae1905455029926314ac685e0ce854c4230fc35a7cdf0fe259

Analysis

max time kernel
426s
max time network
429s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/10/2022, 05:43

Target

7aa5318a4cf3534ee34f0c542620c03608a95040e8a44ac71150c8e48e6e7ddc_unpacked.dll
Size

2.1MB
MD5

bea0168685e05268cfea4f63a298f16b
SHA1

ff82700ee26bbaf5a3357c5f5070fda9f80f9993
SHA256

47b26e0172dff4ae1905455029926314ac685e0ce854c4230fc35a7cdf0fe259
SHA512

789c2d061a0b72162d3b1cd444b10ff89ad6d889efa452c349adbaea2345192df36d62609d0959e76893899b3e55b2a0e25ad86484f8770a21d20c647c143e60
SSDEEP

49152:YZ54VVdEe/9fSvwNMVEy2rElG6CaP3TYeLiuOAGm5d:YjCdENvzVB2glGnKLiu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1900	1972	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 1972	1664	rundll32.exe	28
PID 1664 wrote to memory of 1972	1664	rundll32.exe	28
PID 1664 wrote to memory of 1972	1664	rundll32.exe	28
PID 1664 wrote to memory of 1972	1664	rundll32.exe	28
PID 1664 wrote to memory of 1972	1664	rundll32.exe	28
PID 1664 wrote to memory of 1972	1664	rundll32.exe	28
PID 1664 wrote to memory of 1972	1664	rundll32.exe	28
PID 1972 wrote to memory of 1900	1972	rundll32.exe	29
PID 1972 wrote to memory of 1900	1972	rundll32.exe	29
PID 1972 wrote to memory of 1900	1972	rundll32.exe	29
PID 1972 wrote to memory of 1900	1972	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7aa5318a4cf3534ee34f0c542620c03608a95040e8a44ac71150c8e48e6e7ddc_unpacked.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7aa5318a4cf3534ee34f0c542620c03608a95040e8a44ac71150c8e48e6e7ddc_unpacked.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 244
    3⤵
    - Program crash
    PID:1900

memory/1972-55-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download