c1bee37a1b36bf0277f6b97a0c06e40963d6dfe8642677e0df01366ebde2dbad

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 16:11

Target

c1bee37a1b36bf0277f6b97a0c06e40963d6dfe8642677e0df01366ebde2dbad.dll
Size

915KB
MD5

066c9229aaf7d9336efdf6253a582150
SHA1

0991630ee9d9c8f3ede0984f0595a42230d7959f
SHA256

c1bee37a1b36bf0277f6b97a0c06e40963d6dfe8642677e0df01366ebde2dbad
SHA512

6fb05655a83a9a6a8655c351dbc2b6664b8a350663a14183b2272a5e135dbd37c7f2ce9b2bcdd6e325d06af28e3c35c047df712b19a0377c11dc08bc01d5c202
SSDEEP

12288:5saDxRv9OjVrhWrTMHU9S/gbjD9jSg1cElgbo3GNkxkCyEAdMbsRMN/AEYuJ4AWp:5s+ErWMHU9DhtCWg2xAEdNUfJTA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1232	1340	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28
PID 1340 wrote to memory of 1232	1340	rundll32.exe	29
PID 1340 wrote to memory of 1232	1340	rundll32.exe	29
PID 1340 wrote to memory of 1232	1340	rundll32.exe	29
PID 1340 wrote to memory of 1232	1340	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1bee37a1b36bf0277f6b97a0c06e40963d6dfe8642677e0df01366ebde2dbad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1bee37a1b36bf0277f6b97a0c06e40963d6dfe8642677e0df01366ebde2dbad.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 228
    3⤵
    - Program crash
    PID:1232

memory/1340-55-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/1340-57-0x0000000010000000-0x0000000010144000-memory.dmp

Filesize
1.3MB

Download