56eb5096c6305ea293e48da9040862d733c997a2129b86f9b82a218e417a99ac

Analysis

max time kernel
38s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 02:58

Target

56eb5096c6305ea293e48da9040862d733c997a2129b86f9b82a218e417a99ac.dll
Size

383KB
MD5

3df57c2cdd5d31641e7a38adad7f4ef7
SHA1

c5851e33d8c12b9246561ca4ee4387f6dd346322
SHA256

56eb5096c6305ea293e48da9040862d733c997a2129b86f9b82a218e417a99ac
SHA512

1bc2e168091ebb4a5cf8f97e0add5accbe9cfd636652a91d4ad627e1af2c4d643cab406c16d1d056763533df300fc6a36d03610dc0b03b690efe006e5859e6d0
SSDEEP

6144:78/nEESn5h2MexDvVjYpOQAYm/lGcJ9kmsNoHepCsh8Alyt5JUzBJX:78/EBn5h2MIDv6AYmNpk1N6epCsiAlyg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1956	788	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 788 wrote to memory of 1956	788	rundll32.exe	27
PID 788 wrote to memory of 1956	788	rundll32.exe	27
PID 788 wrote to memory of 1956	788	rundll32.exe	27
PID 788 wrote to memory of 1956	788	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\56eb5096c6305ea293e48da9040862d733c997a2129b86f9b82a218e417a99ac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\56eb5096c6305ea293e48da9040862d733c997a2129b86f9b82a218e417a99ac.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 224
    3⤵
    - Program crash
    PID:1956

memory/788-54-0x0000000000000000-mapping.dmp

Download
memory/788-55-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/1956-56-0x0000000000000000-mapping.dmp

Download