8aa57051e2d9b8d7398e47b5cdabd32df0b28696a32d1d44a8bb6b463b1f3ddb

Analysis

max time kernel
43s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
10/11/2022, 18:25

Target
Softiwe Download/storelibir.dll
Size 259KB
Sample221110-w2ly2secfj
SHA256 5f5ebabf5143c8afcbaa4eff5e92af251ae483acd3a9ddddd2f743ba07e54019
MD5 6fcca15d63300917af99a4c4af4f019f
SHA1 cbb7d0bf456e17c4e91dc0605ad5be19a9346525
SHA512 21aeea4a8d941002f040a81d7c64a23fe548eab3942b68e19d909b6145534da74a8759f1fcf795d5aab781e48bed07d1ca6b912ec0db5af0abf13af6e8365fd7
SSDEEP 3072:+Qzal/XXPLA4AEjJkqNPdYReIBzDY2mASmnNwN7B755CoSsMB91UoxhK9F+g:+QmQ4NPNIBzDYGSmn+NxZMB5jg
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1268	848	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 848	1264	rundll32.exe	27
PID 1264 wrote to memory of 848	1264	rundll32.exe	27
PID 1264 wrote to memory of 848	1264	rundll32.exe	27
PID 1264 wrote to memory of 848	1264	rundll32.exe	27
PID 1264 wrote to memory of 848	1264	rundll32.exe	27
PID 1264 wrote to memory of 848	1264	rundll32.exe	27
PID 1264 wrote to memory of 848	1264	rundll32.exe	27
PID 848 wrote to memory of 1268	848	rundll32.exe	28
PID 848 wrote to memory of 1268	848	rundll32.exe	28
PID 848 wrote to memory of 1268	848	rundll32.exe	28
PID 848 wrote to memory of 1268	848	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Softiwe Download\storelibir.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Softiwe Download\storelibir.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 848 -s 228
    3⤵
    - Program crash
    PID:1268

memory/848-55-0x0000000075601000-0x0000000075603000-memory.dmp

Download