56ab07240d746230de70db9ae5c801c1b9a1e8b9880fbd1b5e686f4aa585c882

Analysis

max time kernel
43s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-10-2022 08:10

Target

56ab07240d746230de70db9ae5c801c1b9a1e8b9880fbd1b5e686f4aa585c882.dll
Size

57KB
MD5

931a85f96f68b394c8bf5d58ebdb45b1
SHA1

bfcd95d83a11c2de91c0f7832a47b20751372d4d
SHA256

56ab07240d746230de70db9ae5c801c1b9a1e8b9880fbd1b5e686f4aa585c882
SHA512

98a69cc5e947884430a14cd3006cd3d27fb41d7fc333d877984798a6f25e1742d77928f0817ba9ac615696788af8ecc790fc61a8762b2fc010a3cfe9d184e3b1
SSDEEP

768:xcxTSIVd3L2LQF10dwJVnO0NkYEmcxTK:xcxTSaYA0dAR1EmcxT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
944	1028	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 1028	1060	rundll32.exe	27
PID 1060 wrote to memory of 1028	1060	rundll32.exe	27
PID 1060 wrote to memory of 1028	1060	rundll32.exe	27
PID 1060 wrote to memory of 1028	1060	rundll32.exe	27
PID 1060 wrote to memory of 1028	1060	rundll32.exe	27
PID 1060 wrote to memory of 1028	1060	rundll32.exe	27
PID 1060 wrote to memory of 1028	1060	rundll32.exe	27
PID 1028 wrote to memory of 944	1028	rundll32.exe	28
PID 1028 wrote to memory of 944	1028	rundll32.exe	28
PID 1028 wrote to memory of 944	1028	rundll32.exe	28
PID 1028 wrote to memory of 944	1028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\56ab07240d746230de70db9ae5c801c1b9a1e8b9880fbd1b5e686f4aa585c882.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\56ab07240d746230de70db9ae5c801c1b9a1e8b9880fbd1b5e686f4aa585c882.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 256
    3⤵
    - Program crash
    PID:944

memory/1028-55-0x0000000075021000-0x0000000075023000-memory.dmp

Filesize
8KB

Download
memory/1028-57-0x0000000020000000-0x0000000020014000-memory.dmp

Filesize
80KB

Download