34921ee280c1cfa8b0056950cd42320145d95f366af9db4db4ed782f2bfc3928

Analysis

max time kernel
146s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:06

Target

34921ee280c1cfa8b0056950cd42320145d95f366af9db4db4ed782f2bfc3928.dll
Size

2.9MB
MD5

46ce1de3254ee1fc6d45108becaee08a
SHA1

104a05770088f4d3333ef2227fe3c051bb821cd5
SHA256

34921ee280c1cfa8b0056950cd42320145d95f366af9db4db4ed782f2bfc3928
SHA512

4105e944facbf8e701b2d66efc12ecd922c1cc5b28b7614ed2b716449b64504c742ab900a5cbb76ab2e60310f7cd6c43a5d8dea9488f91322b0560e112d7baad
SSDEEP

49152:YcLLWIDDzch+kqcpDXriQnH/FjVWRNK0miyb+WXFm5pTWJBRNRFH:lLLFcwkqcpDXri6ZWRoPiRT5dG7NR

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1940 1692 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1940	1692	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1116 wrote to memory of 1692	1116	rundll32.exe	rundll32.exe
PID 1116 wrote to memory of 1692	1116	rundll32.exe	rundll32.exe
PID 1116 wrote to memory of 1692	1116	rundll32.exe	rundll32.exe
PID 1116 wrote to memory of 1692	1116	rundll32.exe	rundll32.exe
PID 1116 wrote to memory of 1692	1116	rundll32.exe	rundll32.exe
PID 1116 wrote to memory of 1692	1116	rundll32.exe	rundll32.exe
PID 1116 wrote to memory of 1692	1116	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 1940	1692	rundll32.exe	WerFault.exe
PID 1692 wrote to memory of 1940	1692	rundll32.exe	WerFault.exe
PID 1692 wrote to memory of 1940	1692	rundll32.exe	WerFault.exe
PID 1692 wrote to memory of 1940	1692	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\34921ee280c1cfa8b0056950cd42320145d95f366af9db4db4ed782f2bfc3928.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1116

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\34921ee280c1cfa8b0056950cd42320145d95f366af9db4db4ed782f2bfc3928.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 264
3⤵
- Program crash
PID:1940

memory/1692-54-0x0000000000000000-mapping.dmp

Download
memory/1692-55-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download
memory/1692-56-0x0000000001F10000-0x0000000002771000-memory.dmp

Filesize
8.4MB

Download
memory/1692-57-0x0000000001F10000-0x0000000002771000-memory.dmp

Filesize
8.4MB

Download
memory/1692-58-0x0000000001F10000-0x0000000002771000-memory.dmp

Filesize
8.4MB

Download
memory/1692-59-0x0000000001F10000-0x0000000002771000-memory.dmp

Filesize
8.4MB

Download
memory/1692-60-0x0000000000120000-0x0000000000126000-memory.dmp

Filesize
24KB

Download
memory/1692-62-0x0000000000120000-0x0000000000126000-memory.dmp

Filesize
24KB

Download
memory/1692-63-0x0000000001F10000-0x0000000002771000-memory.dmp

Filesize
8.4MB

Download
memory/1940-61-0x0000000000000000-mapping.dmp

Download