67ab0ac904751a8c8578d27f8f85f0569d7364bb2d8ee047068a9127a891292c

Analysis

max time kernel
26s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 04:45

Target

67ab0ac904751a8c8578d27f8f85f0569d7364bb2d8ee047068a9127a891292c.dll
Size

124KB
MD5

0c1e282c0e6917358cbd323bc7831552
SHA1

b06bc7670d39274c673fbe7c5971e32b5c335ed5
SHA256

67ab0ac904751a8c8578d27f8f85f0569d7364bb2d8ee047068a9127a891292c
SHA512

1c9e78c31a7e6a2e3d8fd513106d656618dce48f9ca4448e25f8d9c6f6a3fccf861c130be51431453fd09bd49c97a2e95afdd79a0e40de7158c657f6aeb25d4e
SSDEEP

768:wfIhXaz8Ra9U8/19A5AhzcI+/idoCG+8xcYytV9LZKGQszl2kqLbZK3XT8O5Y8:wghXazoIhNXd0xspLZzzl2kuYHoO

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\windhcp.ocx	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\windhcp.ocx	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1992	1940	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1940	rundll32.exe
1940	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1940	900	rundll32.exe	27
PID 900 wrote to memory of 1940	900	rundll32.exe	27
PID 900 wrote to memory of 1940	900	rundll32.exe	27
PID 900 wrote to memory of 1940	900	rundll32.exe	27
PID 900 wrote to memory of 1940	900	rundll32.exe	27
PID 900 wrote to memory of 1940	900	rundll32.exe	27
PID 900 wrote to memory of 1940	900	rundll32.exe	27
PID 1940 wrote to memory of 1992	1940	rundll32.exe	28
PID 1940 wrote to memory of 1992	1940	rundll32.exe	28
PID 1940 wrote to memory of 1992	1940	rundll32.exe	28
PID 1940 wrote to memory of 1992	1940	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\67ab0ac904751a8c8578d27f8f85f0569d7364bb2d8ee047068a9127a891292c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\67ab0ac904751a8c8578d27f8f85f0569d7364bb2d8ee047068a9127a891292c.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 228
    3⤵
    - Program crash
    PID:1992

memory/1940-55-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download
memory/1940-57-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download