32e1e706deb323e773f5081b3cf7391fc258604d50e512298903f02bc60625ad

Analysis

max time kernel
18s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 22:52

Target

32e1e706deb323e773f5081b3cf7391fc258604d50e512298903f02bc60625ad.dll
Size

170KB
MD5

844bb3da1bbd49324e91a815c84302ec
SHA1

7746eaa21ac81d55123f753da7cf2781a8945415
SHA256

32e1e706deb323e773f5081b3cf7391fc258604d50e512298903f02bc60625ad
SHA512

57125e6c412d0615d51e400c4875c3b4d5bc577c61588d7342276202b2dedd44b580af1448b34368a5a1229eeee708a2bf390fff99569cd5cfe3b408637ba8f5
SSDEEP

3072:25jAaL17ZppHO5lV+EHfjvEnZumUPiwMMQVFfT3CFpt9P6oCub:ZVRHbvsSPiwMlvmFZcu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1744	1636	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 1636	908	rundll32.exe	27
PID 908 wrote to memory of 1636	908	rundll32.exe	27
PID 908 wrote to memory of 1636	908	rundll32.exe	27
PID 908 wrote to memory of 1636	908	rundll32.exe	27
PID 908 wrote to memory of 1636	908	rundll32.exe	27
PID 908 wrote to memory of 1636	908	rundll32.exe	27
PID 908 wrote to memory of 1636	908	rundll32.exe	27
PID 1636 wrote to memory of 1744	1636	rundll32.exe	28
PID 1636 wrote to memory of 1744	1636	rundll32.exe	28
PID 1636 wrote to memory of 1744	1636	rundll32.exe	28
PID 1636 wrote to memory of 1744	1636	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\32e1e706deb323e773f5081b3cf7391fc258604d50e512298903f02bc60625ad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\32e1e706deb323e773f5081b3cf7391fc258604d50e512298903f02bc60625ad.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 228
    3⤵
    - Program crash
    PID:1744

memory/1636-55-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/1636-56-0x0000000000190000-0x00000000001A4000-memory.dmp

Filesize
80KB

Download
memory/1636-57-0x00000000001B0000-0x00000000001DD000-memory.dmp

Filesize
180KB

Download
memory/1636-61-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download
memory/1636-63-0x0000000000190000-0x00000000001A4000-memory.dmp

Filesize
80KB

Download