5a70f5b647ecc08bb8556a22f464a89d8d1e5ce535d84cf6162bea0434a7358a

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:10

Target

5a70f5b647ecc08bb8556a22f464a89d8d1e5ce535d84cf6162bea0434a7358a.dll
Size

505KB
MD5

c08589e10812cc7d636dcbe2a36d43b4
SHA1

5cb2b072979ee3bf5cfb86b013ed6ecaa99fc789
SHA256

5a70f5b647ecc08bb8556a22f464a89d8d1e5ce535d84cf6162bea0434a7358a
SHA512

09027eb401524fd20dcb6f7e6e6289ce4872f7431fcff499384cdb10c44959acde5cb4112103f90a1fb5eb7dfafc2153defaf52c3bd0d6978a1f7225551ac7d4
SSDEEP

6144:WE8fS4+U276ViY4nzabW9IMJJqycMvd5wMyqrWaTM:WRSRZ9/aq7JRcMv7wMFrWGM

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1680 944 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1680	944	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1696 wrote to memory of 944	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 944	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 944	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 944	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 944	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 944	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 944	1696	rundll32.exe	rundll32.exe
PID 944 wrote to memory of 1680	944	rundll32.exe	WerFault.exe
PID 944 wrote to memory of 1680	944	rundll32.exe	WerFault.exe
PID 944 wrote to memory of 1680	944	rundll32.exe	WerFault.exe
PID 944 wrote to memory of 1680	944	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a70f5b647ecc08bb8556a22f464a89d8d1e5ce535d84cf6162bea0434a7358a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1696

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a70f5b647ecc08bb8556a22f464a89d8d1e5ce535d84cf6162bea0434a7358a.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 944 -s 240
3⤵
- Program crash
PID:1680

memory/944-54-0x0000000000000000-mapping.dmp

Download
memory/944-55-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/1680-56-0x0000000000000000-mapping.dmp

Download