7d065ad904f4c9d9aeb02b0c209117594b42cc7cb93d5522624b3c2e834db779

Analysis

max time kernel
37s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-10-2022 01:04

Target

7d065ad904f4c9d9aeb02b0c209117594b42cc7cb93d5522624b3c2e834db779.dll
Size

80KB
MD5

93745d546f99724a1e5e016f58189e7a
SHA1

be6eda95f6038d44eca7105d6fe5f1d1ec5f099f
SHA256

7d065ad904f4c9d9aeb02b0c209117594b42cc7cb93d5522624b3c2e834db779
SHA512

f4aafab980e40bebf002e5560aad5d7bce4648e3968e7903054d0b02b8d78679720a235fb9536a04449825d8e5128e12b0aa33182da703375b3f55ae424977f5
SSDEEP

1536:KNH10aOP0ObKPryM5U1cTsFx1phwWvQWT0:OPOPeZU1h6WvQ20

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1984	2032	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 2032	784	rundll32.exe	26
PID 784 wrote to memory of 2032	784	rundll32.exe	26
PID 784 wrote to memory of 2032	784	rundll32.exe	26
PID 784 wrote to memory of 2032	784	rundll32.exe	26
PID 784 wrote to memory of 2032	784	rundll32.exe	26
PID 784 wrote to memory of 2032	784	rundll32.exe	26
PID 784 wrote to memory of 2032	784	rundll32.exe	26
PID 2032 wrote to memory of 1984	2032	rundll32.exe	27
PID 2032 wrote to memory of 1984	2032	rundll32.exe	27
PID 2032 wrote to memory of 1984	2032	rundll32.exe	27
PID 2032 wrote to memory of 1984	2032	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d065ad904f4c9d9aeb02b0c209117594b42cc7cb93d5522624b3c2e834db779.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d065ad904f4c9d9aeb02b0c209117594b42cc7cb93d5522624b3c2e834db779.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 228
    3⤵
    - Program crash
    PID:1984

memory/1984-56-0x0000000000000000-mapping.dmp

Download
memory/2032-54-0x0000000000000000-mapping.dmp

Download
memory/2032-55-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

Filesize
8KB

Download