d69191a657e880854050b9d301ccb079910cbb4fbad6dee452ae31c79cb7feda

Analysis

max time kernel
27s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 23:23

Target

d69191a657e880854050b9d301ccb079910cbb4fbad6dee452ae31c79cb7feda.dll
Size

293KB
MD5

05fedd1a1c78fcef6ff6ddda5b490d10
SHA1

52f2059f92fa68b98000a9cc9c54e1e669ca659e
SHA256

d69191a657e880854050b9d301ccb079910cbb4fbad6dee452ae31c79cb7feda
SHA512

5434215475b7ad17ca00f49abd9c9724ab7d2318cdc4b7fe0b39ad6cdd6062f8831e13a264af7bfaf692a61fac119437465f613baaf786fcac89d6806c4c4a3c
SSDEEP

6144:bXztUh19gGaO4HCEfBmqO/JO9YZzovGSkGBOEy1zqAHZ:lyOiWBmTkyBS61nHZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
784	1956	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1956	1160	rundll32.exe	28
PID 1160 wrote to memory of 1956	1160	rundll32.exe	28
PID 1160 wrote to memory of 1956	1160	rundll32.exe	28
PID 1160 wrote to memory of 1956	1160	rundll32.exe	28
PID 1160 wrote to memory of 1956	1160	rundll32.exe	28
PID 1160 wrote to memory of 1956	1160	rundll32.exe	28
PID 1160 wrote to memory of 1956	1160	rundll32.exe	28
PID 1956 wrote to memory of 784	1956	rundll32.exe	29
PID 1956 wrote to memory of 784	1956	rundll32.exe	29
PID 1956 wrote to memory of 784	1956	rundll32.exe	29
PID 1956 wrote to memory of 784	1956	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d69191a657e880854050b9d301ccb079910cbb4fbad6dee452ae31c79cb7feda.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d69191a657e880854050b9d301ccb079910cbb4fbad6dee452ae31c79cb7feda.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 276
    3⤵
    - Program crash
    PID:784

memory/1956-55-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/1956-56-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/1956-57-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/1956-59-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download