62b074d84c3a3eafb02db077aabe3c0ee2682db0a482b4a142b9ee4b51da7884

Analysis

max time kernel
3s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 14:09

Target

62b074d84c3a3eafb02db077aabe3c0ee2682db0a482b4a142b9ee4b51da7884.dll
Size

331KB
MD5

0c9b49151dc8ca6af138aece776d4483
SHA1

1991c538ea09f61f536281bc4a080d28b8cdde01
SHA256

62b074d84c3a3eafb02db077aabe3c0ee2682db0a482b4a142b9ee4b51da7884
SHA512

7879cd6acea25075ba32216a9e704339d75af2400218bba695c99abd205f27945d69b0d59cf9a513c075b48d79df1b9dc9ba4e2084d017a3081aa03d8ff4b4c9
SSDEEP

6144:76eIGEriPta3gxZC2hYvnYBU8UaPoqhS4zlXW4kgrqorY4Erl/51p9iQoAIrhdy:7UsbRQp9iQ61dy

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

820 1236 WerFault.exe rundll32.exe

pid	pid_target	process	target process
820	1236	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1808 wrote to memory of 1236	1808	rundll32.exe	rundll32.exe
PID 1808 wrote to memory of 1236	1808	rundll32.exe	rundll32.exe
PID 1808 wrote to memory of 1236	1808	rundll32.exe	rundll32.exe
PID 1808 wrote to memory of 1236	1808	rundll32.exe	rundll32.exe
PID 1808 wrote to memory of 1236	1808	rundll32.exe	rundll32.exe
PID 1808 wrote to memory of 1236	1808	rundll32.exe	rundll32.exe
PID 1808 wrote to memory of 1236	1808	rundll32.exe	rundll32.exe
PID 1236 wrote to memory of 820	1236	rundll32.exe	WerFault.exe
PID 1236 wrote to memory of 820	1236	rundll32.exe	WerFault.exe
PID 1236 wrote to memory of 820	1236	rundll32.exe	WerFault.exe
PID 1236 wrote to memory of 820	1236	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\62b074d84c3a3eafb02db077aabe3c0ee2682db0a482b4a142b9ee4b51da7884.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\62b074d84c3a3eafb02db077aabe3c0ee2682db0a482b4a142b9ee4b51da7884.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 256
    3⤵
    - Program crash
    PID:820

memory/820-60-0x0000000000000000-mapping.dmp

Download
memory/1236-54-0x0000000000000000-mapping.dmp

Download
memory/1236-55-0x0000000075991000-0x0000000075993000-memory.dmp

Filesize
8KB

Download
memory/1236-56-0x0000000000860000-0x00000000008B6000-memory.dmp

Filesize
344KB

Download
memory/1236-61-0x00000000007F0000-0x000000000084A000-memory.dmp

Filesize
360KB

Download