92c5ffef9f5ab165aa4441395cd518b5fd8094bc6b231eca782b88ea3c488d78

Analysis

max time kernel
16s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:39

Target

92c5ffef9f5ab165aa4441395cd518b5fd8094bc6b231eca782b88ea3c488d78.dll
Size

332KB
MD5

1132b53168c3687b8583d155dfa2d77a
SHA1

08b4fac1af1799efb9121b49170eb032ce46cead
SHA256

92c5ffef9f5ab165aa4441395cd518b5fd8094bc6b231eca782b88ea3c488d78
SHA512

a4c570c03d6a6085f848f1d8d7d8c733a169acaa0261345abc841690e9e880eccde6cb6665612d506f4b327dc2246648c834405264abcb53ebd98043a3f73098
SSDEEP

6144:keMSB+bSPNqYx1tgyY7fR5hWCvorsatRVF/beTx4OCsmD7y+HhHeNBQ0Vw5:kpSecqKgzZ7atd0NDey+2BQ2w5

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

936 1888 WerFault.exe rundll32.exe

pid	pid_target	process	target process
936	1888	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1160 wrote to memory of 1888	1160	rundll32.exe	rundll32.exe
PID 1160 wrote to memory of 1888	1160	rundll32.exe	rundll32.exe
PID 1160 wrote to memory of 1888	1160	rundll32.exe	rundll32.exe
PID 1160 wrote to memory of 1888	1160	rundll32.exe	rundll32.exe
PID 1160 wrote to memory of 1888	1160	rundll32.exe	rundll32.exe
PID 1160 wrote to memory of 1888	1160	rundll32.exe	rundll32.exe
PID 1160 wrote to memory of 1888	1160	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 936	1888	rundll32.exe	WerFault.exe
PID 1888 wrote to memory of 936	1888	rundll32.exe	WerFault.exe
PID 1888 wrote to memory of 936	1888	rundll32.exe	WerFault.exe
PID 1888 wrote to memory of 936	1888	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92c5ffef9f5ab165aa4441395cd518b5fd8094bc6b231eca782b88ea3c488d78.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1160

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92c5ffef9f5ab165aa4441395cd518b5fd8094bc6b231eca782b88ea3c488d78.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 236
3⤵
- Program crash
PID:936

memory/936-60-0x0000000000000000-mapping.dmp

Download
memory/1888-54-0x0000000000000000-mapping.dmp

Download
memory/1888-55-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/1888-56-0x0000000000290000-0x00000000002E5000-memory.dmp

Filesize
340KB

Download
memory/1888-61-0x00000000001B0000-0x000000000020B000-memory.dmp

Filesize
364KB

Download