3cb95b22281283d3a4b74fc56e1f8409788394ee3076dd1c2396d6d683323958

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 14:32

Target

3cb95b22281283d3a4b74fc56e1f8409788394ee3076dd1c2396d6d683323958.dll
Size

501KB
MD5

dd07315e001b692fc05e32c8f3f8dc81
SHA1

ae4357f5025c141c7357fada829584221bb9b004
SHA256

3cb95b22281283d3a4b74fc56e1f8409788394ee3076dd1c2396d6d683323958
SHA512

49d51b5a6795c50a17debd41bd966637105f2456c8f54c171784f87773a9fb548494132fbda6777f3bae334b46c470b04fb0d2a0ee843a0d3baab3f16f362618
SSDEEP

12288:5eHgyLlM1U3WC1i6Opa7IVSnLTD+mO1AXNxSpPM/3LVx55rVJUCA:IHgyLlM1UuTpcmST+91AX7355x

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

944 900 WerFault.exe rundll32.exe

pid	pid_target	process	target process
944	900	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1956 wrote to memory of 900	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 900	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 900	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 900	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 900	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 900	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 900	1956	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 944	900	rundll32.exe	WerFault.exe
PID 900 wrote to memory of 944	900	rundll32.exe	WerFault.exe
PID 900 wrote to memory of 944	900	rundll32.exe	WerFault.exe
PID 900 wrote to memory of 944	900	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3cb95b22281283d3a4b74fc56e1f8409788394ee3076dd1c2396d6d683323958.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3cb95b22281283d3a4b74fc56e1f8409788394ee3076dd1c2396d6d683323958.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 256
3⤵
- Program crash
PID:944

memory/900-54-0x0000000000000000-mapping.dmp

Download
memory/900-55-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/900-56-0x0000000000390000-0x0000000000412000-memory.dmp

Filesize
520KB

Download
memory/900-61-0x0000000000280000-0x00000000002F9000-memory.dmp

Filesize
484KB

Download
memory/944-60-0x0000000000000000-mapping.dmp

Download