db7df618c47b0153f57bbcc14b1bfd892ebb0e932fe37bc5716ef50bbbf28582

Analysis

max time kernel
36s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 12:56

Target

db7df618c47b0153f57bbcc14b1bfd892ebb0e932fe37bc5716ef50bbbf28582.dll
Size

409KB
MD5

0ea11abe07e15b147fc8b9ca5f4224d9
SHA1

505276e45b1a3d0f4ff330b0f69f3188645cf95b
SHA256

db7df618c47b0153f57bbcc14b1bfd892ebb0e932fe37bc5716ef50bbbf28582
SHA512

91eb30902250597acad3d7a1d21d9169763ccd3ac654d48f0d5c8e48c3274bfc36536040506bb23b2cbe4384ea9ec28bd26437e77da4ebecc1c52d80c39a243e
SSDEEP

12288:MEUqrbLsWX2FL7cDlLBnNDOXmrtYvxwlPgL9n:KGLdUL7AnNtYvxwlK

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

948 1496 WerFault.exe rundll32.exe

pid	pid_target	process	target process
948	1496	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2016 wrote to memory of 1496	2016	rundll32.exe	rundll32.exe
PID 2016 wrote to memory of 1496	2016	rundll32.exe	rundll32.exe
PID 2016 wrote to memory of 1496	2016	rundll32.exe	rundll32.exe
PID 2016 wrote to memory of 1496	2016	rundll32.exe	rundll32.exe
PID 2016 wrote to memory of 1496	2016	rundll32.exe	rundll32.exe
PID 2016 wrote to memory of 1496	2016	rundll32.exe	rundll32.exe
PID 2016 wrote to memory of 1496	2016	rundll32.exe	rundll32.exe
PID 1496 wrote to memory of 948	1496	rundll32.exe	WerFault.exe
PID 1496 wrote to memory of 948	1496	rundll32.exe	WerFault.exe
PID 1496 wrote to memory of 948	1496	rundll32.exe	WerFault.exe
PID 1496 wrote to memory of 948	1496	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\db7df618c47b0153f57bbcc14b1bfd892ebb0e932fe37bc5716ef50bbbf28582.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\db7df618c47b0153f57bbcc14b1bfd892ebb0e932fe37bc5716ef50bbbf28582.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 236
3⤵
- Program crash
PID:948

memory/948-63-0x0000000000000000-mapping.dmp

Download
memory/1496-54-0x0000000000000000-mapping.dmp

Download
memory/1496-55-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/1496-56-0x00000000007D0000-0x0000000000839000-memory.dmp

Filesize
420KB

Download
memory/1496-60-0x0000000010000000-0x0000000010069000-memory.dmp

Filesize
420KB

Download
memory/1496-61-0x00000000007D0000-0x0000000000839000-memory.dmp

Filesize
420KB

Download
memory/1496-62-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1496-64-0x00000000002F0000-0x0000000000351000-memory.dmp

Filesize
388KB

Download