a68330557c97c1a7c10b266811cde79e3654fe711ed09d9fe3d88b3f638e6ccd

Analysis

max time kernel
35s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 09:33

Target

a68330557c97c1a7c10b266811cde79e3654fe711ed09d9fe3d88b3f638e6ccd.dll
Size

293KB
MD5

0caee05cc0dae856414261c221ffe32d
SHA1

3e3f3be00123e0183bf44ae6f2315f033edd4e82
SHA256

a68330557c97c1a7c10b266811cde79e3654fe711ed09d9fe3d88b3f638e6ccd
SHA512

5099161c72ebf9042e41f079a7718e27ca5b32cf5549237d9cba2d784821eafa270b21ad3019456b37419f3dc7b35792a55b5991449a79b7ac65a264d1bd6058
SSDEEP

6144:KR7seWPRYXJ7ag+tHwzZa0vd1H0AI8FofwHKO6h7d9:KFseAcJOPta7I0CwHKO6hD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1292	1956	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 1956	1476	rundll32.exe	27
PID 1476 wrote to memory of 1956	1476	rundll32.exe	27
PID 1476 wrote to memory of 1956	1476	rundll32.exe	27
PID 1476 wrote to memory of 1956	1476	rundll32.exe	27
PID 1476 wrote to memory of 1956	1476	rundll32.exe	27
PID 1476 wrote to memory of 1956	1476	rundll32.exe	27
PID 1476 wrote to memory of 1956	1476	rundll32.exe	27
PID 1956 wrote to memory of 1292	1956	rundll32.exe	28
PID 1956 wrote to memory of 1292	1956	rundll32.exe	28
PID 1956 wrote to memory of 1292	1956	rundll32.exe	28
PID 1956 wrote to memory of 1292	1956	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a68330557c97c1a7c10b266811cde79e3654fe711ed09d9fe3d88b3f638e6ccd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a68330557c97c1a7c10b266811cde79e3654fe711ed09d9fe3d88b3f638e6ccd.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 256
    3⤵
    - Program crash
    PID:1292

memory/1956-55-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download
memory/1956-56-0x0000000000270000-0x00000000002BB000-memory.dmp

Filesize
300KB

Download
memory/1956-61-0x00000000001D0000-0x0000000000217000-memory.dmp

Filesize
284KB

Download