4d4a1a23c24cee9001a5a6664d7bf2a79d3b45205643bbce5ede2a50fda16c37

Analysis

max time kernel
25s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23/11/2022, 19:26

Target

4d4a1a23c24cee9001a5a6664d7bf2a79d3b45205643bbce5ede2a50fda16c37.dll
Size

107KB
MD5

6dab3a9f452dce71e0d557118753b8fe
SHA1

97b890f01e8b4be01d6445d59c31b6e3570d455c
SHA256

4d4a1a23c24cee9001a5a6664d7bf2a79d3b45205643bbce5ede2a50fda16c37
SHA512

3fa0a596bb68d761804a093e8878481893645681aeb7935b552035264de1cbad5bea8352118ccb6012eb9ad47c03dbd427b3d5f9236c6a2491021a33fd472394
SSDEEP

1536:cxzEOBCPtQiYVH7lAdy2EixSNdMPP26k9Zn+dzSeQCRz9Wp:cJUbSwR0uP2qmeQCRz9W

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1812	1228	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 1228	828	rundll32.exe	28
PID 828 wrote to memory of 1228	828	rundll32.exe	28
PID 828 wrote to memory of 1228	828	rundll32.exe	28
PID 828 wrote to memory of 1228	828	rundll32.exe	28
PID 828 wrote to memory of 1228	828	rundll32.exe	28
PID 828 wrote to memory of 1228	828	rundll32.exe	28
PID 828 wrote to memory of 1228	828	rundll32.exe	28
PID 1228 wrote to memory of 1812	1228	rundll32.exe	29
PID 1228 wrote to memory of 1812	1228	rundll32.exe	29
PID 1228 wrote to memory of 1812	1228	rundll32.exe	29
PID 1228 wrote to memory of 1812	1228	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d4a1a23c24cee9001a5a6664d7bf2a79d3b45205643bbce5ede2a50fda16c37.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d4a1a23c24cee9001a5a6664d7bf2a79d3b45205643bbce5ede2a50fda16c37.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 232
    3⤵
    - Program crash
    PID:1812

memory/1228-55-0x0000000075C41000-0x0000000075C43000-memory.dmp

Filesize
8KB

Download