a601b6788af99d5b8d6dfd1db5823194dac116504ef501c3e10c796ae21eb07e

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 11:40

Target

a601b6788af99d5b8d6dfd1db5823194dac116504ef501c3e10c796ae21eb07e.dll
Size

1.7MB
MD5

04af8b23c2b2b994e6ae2c9c75372a87
SHA1

cf366e9e58c3f7233e524ca9ac79f5675bf891cd
SHA256

a601b6788af99d5b8d6dfd1db5823194dac116504ef501c3e10c796ae21eb07e
SHA512

60e55ba4ab827244d4159cf35a92536f6e2df007476e9c359513ec86c4ffe535927ceaf6d9577621de1498a62d33b04c79963d08c1b73883907c1f58ebf18e62
SSDEEP

49152:76WmW/wwZJ7oOtagY0Zj8U1R5PHCcqptuQmM5e:7hXniGvhCcqptlC

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 28 IoCs

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1764	1156	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 1156	1604	rundll32.exe	27
PID 1604 wrote to memory of 1156	1604	rundll32.exe	27
PID 1604 wrote to memory of 1156	1604	rundll32.exe	27
PID 1604 wrote to memory of 1156	1604	rundll32.exe	27
PID 1604 wrote to memory of 1156	1604	rundll32.exe	27
PID 1604 wrote to memory of 1156	1604	rundll32.exe	27
PID 1604 wrote to memory of 1156	1604	rundll32.exe	27
PID 1156 wrote to memory of 1764	1156	rundll32.exe	28
PID 1156 wrote to memory of 1764	1156	rundll32.exe	28
PID 1156 wrote to memory of 1764	1156	rundll32.exe	28
PID 1156 wrote to memory of 1764	1156	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a601b6788af99d5b8d6dfd1db5823194dac116504ef501c3e10c796ae21eb07e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a601b6788af99d5b8d6dfd1db5823194dac116504ef501c3e10c796ae21eb07e.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 372
    3⤵
    - Program crash
    PID:1764

memory/1156-55-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download
memory/1156-56-0x0000000072E90000-0x00000000738B4000-memory.dmp

Filesize
10.1MB

Download
memory/1156-61-0x0000000072E90000-0x00000000738B4000-memory.dmp

Filesize
10.1MB

Download
memory/1156-60-0x0000000073FC0000-0x00000000749E4000-memory.dmp

Filesize
10.1MB

Download
memory/1156-62-0x0000000073FC0000-0x00000000749E4000-memory.dmp

Filesize
10.1MB

Download