3785145a3c628a36b8c44f1fe9615b07ae94c2e4b50a35128770bbc7d97929d4

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 14:35

Target

3785145a3c628a36b8c44f1fe9615b07ae94c2e4b50a35128770bbc7d97929d4.dll
Size

373KB
MD5

e15f12b9f21da0e7f9e985cbeead6d46
SHA1

3106461a518ad16736c4c8f3c8db83c41cfa6f2d
SHA256

3785145a3c628a36b8c44f1fe9615b07ae94c2e4b50a35128770bbc7d97929d4
SHA512

2fabe3a5e69f1a5bd03c8ba3aa400ac2b5199e7382447d29ea2cbb1cd06f62db0eaebb9db38b923989287418bf67ff699f083e662c4d253824794bcefc4a54e5
SSDEEP

6144:rBr+MxKVENsNM+kssGhKNS4/E0QZgoQ92uHfBQN+9+Tqgzda:rBr9NsNMFGhKFKZ1QU6S7TNpa

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1536 1632 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1536	1632	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1636 wrote to memory of 1632	1636	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 1632	1636	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 1632	1636	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 1632	1636	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 1632	1636	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 1632	1636	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 1632	1636	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 1536	1632	rundll32.exe	WerFault.exe
PID 1632 wrote to memory of 1536	1632	rundll32.exe	WerFault.exe
PID 1632 wrote to memory of 1536	1632	rundll32.exe	WerFault.exe
PID 1632 wrote to memory of 1536	1632	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3785145a3c628a36b8c44f1fe9615b07ae94c2e4b50a35128770bbc7d97929d4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3785145a3c628a36b8c44f1fe9615b07ae94c2e4b50a35128770bbc7d97929d4.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 228
3⤵
- Program crash
PID:1536

memory/1536-61-0x0000000000000000-mapping.dmp

Download
memory/1632-54-0x0000000000000000-mapping.dmp

Download
memory/1632-55-0x0000000075211000-0x0000000075213000-memory.dmp

Filesize
8KB

Download
memory/1632-56-0x00000000003C0000-0x0000000000420000-memory.dmp

Filesize
384KB

Download
memory/1632-60-0x00000000001C0000-0x0000000000220000-memory.dmp

Filesize
384KB

Download