ca990d69d4c5327b47b0879c0c18b5da523b7c42b0c2eaae7d1c2bbea14fa526

Analysis

max time kernel
52s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:07

Target

ca990d69d4c5327b47b0879c0c18b5da523b7c42b0c2eaae7d1c2bbea14fa526.dll
Size

367KB
MD5

b967e8d2035df41dd9c17ed7e5033d35
SHA1

7c0f02dd0e88c211aca42f66d7c068d36553bb09
SHA256

ca990d69d4c5327b47b0879c0c18b5da523b7c42b0c2eaae7d1c2bbea14fa526
SHA512

345b55594c48b6d5c153ec6590e37b12c2ff91e5b688f55e1f95b14eb521855e368aae715b7ea903af42333dd8ed29b598ed8f4b3e7c5f00195a1a64d9276e91
SSDEEP

6144:NRzywnWbICLtBsyQmEy+oiaOBQF+vMnA7Izu98P6LmMUYct1:TzywnWbjchz8OiuNrRct1

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

688 1192 WerFault.exe rundll32.exe

pid	pid_target	process	target process
688	1192	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2044 wrote to memory of 1192	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 1192	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 1192	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 1192	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 1192	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 1192	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 1192	2044	rundll32.exe	rundll32.exe
PID 1192 wrote to memory of 688	1192	rundll32.exe	WerFault.exe
PID 1192 wrote to memory of 688	1192	rundll32.exe	WerFault.exe
PID 1192 wrote to memory of 688	1192	rundll32.exe	WerFault.exe
PID 1192 wrote to memory of 688	1192	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca990d69d4c5327b47b0879c0c18b5da523b7c42b0c2eaae7d1c2bbea14fa526.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca990d69d4c5327b47b0879c0c18b5da523b7c42b0c2eaae7d1c2bbea14fa526.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 252
3⤵
- Program crash
PID:688

memory/688-60-0x0000000000000000-mapping.dmp

Download
memory/1192-54-0x0000000000000000-mapping.dmp

Download
memory/1192-55-0x0000000076221000-0x0000000076223000-memory.dmp

Filesize
8KB

Download
memory/1192-56-0x0000000000230000-0x000000000028F000-memory.dmp

Filesize
380KB

Download
memory/1192-61-0x0000000000190000-0x00000000001C8000-memory.dmp

Filesize
224KB

Download