762f9c676c1ebd9493e3ed7c5e4d1673457190484e6b52c51bcfbcc3cd366a39

Analysis

max time kernel
33s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 12:45

Target

762f9c676c1ebd9493e3ed7c5e4d1673457190484e6b52c51bcfbcc3cd366a39.dll
Size

9KB
MD5

a29a68fc66533f63be44e8d84d7595a0
SHA1

b6f92b7ff63c810c5ba99b02f6a9aca14e34a212
SHA256

762f9c676c1ebd9493e3ed7c5e4d1673457190484e6b52c51bcfbcc3cd366a39
SHA512

6ceadb3a8cb31f151bfbaee7b0ec817e5a2776c264761abb3119c09cfee9159f0c5370c2a9f15b8e3fba597f9c027a5f2432231a1539a896b4fb472abc66ef7d
SSDEEP

192:sNo5kmXmEEnkITKoUBQIEtNvokhF5hDJtKfnv23qJthDN:i1mWEHI2oT7Nh9Dqv6qJtN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
844	1372	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 1372	1348	rundll32.exe	26
PID 1348 wrote to memory of 1372	1348	rundll32.exe	26
PID 1348 wrote to memory of 1372	1348	rundll32.exe	26
PID 1348 wrote to memory of 1372	1348	rundll32.exe	26
PID 1348 wrote to memory of 1372	1348	rundll32.exe	26
PID 1348 wrote to memory of 1372	1348	rundll32.exe	26
PID 1348 wrote to memory of 1372	1348	rundll32.exe	26
PID 1372 wrote to memory of 844	1372	rundll32.exe	27
PID 1372 wrote to memory of 844	1372	rundll32.exe	27
PID 1372 wrote to memory of 844	1372	rundll32.exe	27
PID 1372 wrote to memory of 844	1372	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\762f9c676c1ebd9493e3ed7c5e4d1673457190484e6b52c51bcfbcc3cd366a39.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\762f9c676c1ebd9493e3ed7c5e4d1673457190484e6b52c51bcfbcc3cd366a39.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 236
    3⤵
    - Program crash
    PID:844

memory/1372-55-0x00000000750A1000-0x00000000750A3000-memory.dmp

Filesize
8KB

Download
memory/1372-56-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download