bc19ab1b84c4378cffc41f4e97c2faae2f101829b093ee469a1e67a82c6cf875

Analysis

max time kernel
3s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23/11/2022, 22:08

Target

bc19ab1b84c4378cffc41f4e97c2faae2f101829b093ee469a1e67a82c6cf875.dll
Size

157KB
MD5

44218164e3061b3444604b58efbddfd9
SHA1

5bc58999eba005a5f630b7eb847404ec3469d6a2
SHA256

bc19ab1b84c4378cffc41f4e97c2faae2f101829b093ee469a1e67a82c6cf875
SHA512

961ad6728a68183153d6c5d81a74280d67e7e08d55a5e3746fbffb26d85a53b6951ba1294a04e232f8825617f1b90f5b56fb914bbb81b92137455f679fd512b4
SSDEEP

1536:bgLIMoIVIJkuvfZ/Auw6sUB8BuegomYT/zkwqiQjvesIyX6+a8oO2Er5Pp5IE7K8:bcKiyxvfGFueKETqiQ7hDRBZ7KK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
296	1748	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1748	1728	rundll32.exe	28
PID 1728 wrote to memory of 1748	1728	rundll32.exe	28
PID 1728 wrote to memory of 1748	1728	rundll32.exe	28
PID 1728 wrote to memory of 1748	1728	rundll32.exe	28
PID 1728 wrote to memory of 1748	1728	rundll32.exe	28
PID 1728 wrote to memory of 1748	1728	rundll32.exe	28
PID 1728 wrote to memory of 1748	1728	rundll32.exe	28
PID 1748 wrote to memory of 296	1748	rundll32.exe	29
PID 1748 wrote to memory of 296	1748	rundll32.exe	29
PID 1748 wrote to memory of 296	1748	rundll32.exe	29
PID 1748 wrote to memory of 296	1748	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc19ab1b84c4378cffc41f4e97c2faae2f101829b093ee469a1e67a82c6cf875.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc19ab1b84c4378cffc41f4e97c2faae2f101829b093ee469a1e67a82c6cf875.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 252
    3⤵
    - Program crash
    PID:296

memory/1748-55-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

Filesize
8KB

Download
memory/1748-57-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download