8e0e38ed2f8c46569c0b1d250f3e66b190d256a7fa0824bd5d3e8bf215fb5ce2

Analysis

max time kernel
41s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 22:24

Target

rxbaoV3.29_Y/bb.dll
Size

97KB
MD5

040aae2e851338bdce796420914e928a
SHA1

97600fbd2fec878923a722bc054e3e4803127f8f
SHA256

a36b0b3703928f46c9f648910eeff253aa6fa702614e173e05b95d902416d8d2
SHA512

ca63da2e759f5c7c2cf17619131b2e26a8cadbede291005546634593aaa16baefec302e4586c232e9f550e1ae4a2d1b2e8ffe1e98f4ade7d49ea59c1e4c6c82c
SSDEEP

1536:wkxaf6YvvCiBAR66FIU66zKZyUqRWnLwNPoAyqyuy5d98xCUzan1SKmHI:woYO66FxeUHWAyJ5daxCUzK1SKT

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1124 1000 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1124	1000	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 956 wrote to memory of 1000	956	rundll32.exe	rundll32.exe
PID 956 wrote to memory of 1000	956	rundll32.exe	rundll32.exe
PID 956 wrote to memory of 1000	956	rundll32.exe	rundll32.exe
PID 956 wrote to memory of 1000	956	rundll32.exe	rundll32.exe
PID 956 wrote to memory of 1000	956	rundll32.exe	rundll32.exe
PID 956 wrote to memory of 1000	956	rundll32.exe	rundll32.exe
PID 956 wrote to memory of 1000	956	rundll32.exe	rundll32.exe
PID 1000 wrote to memory of 1124	1000	rundll32.exe	WerFault.exe
PID 1000 wrote to memory of 1124	1000	rundll32.exe	WerFault.exe
PID 1000 wrote to memory of 1124	1000	rundll32.exe	WerFault.exe
PID 1000 wrote to memory of 1124	1000	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\rxbaoV3.29_Y\bb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\rxbaoV3.29_Y\bb.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 224
    3⤵
    - Program crash
    PID:1124

memory/1000-54-0x0000000000000000-mapping.dmp

Download
memory/1000-55-0x00000000754F1000-0x00000000754F3000-memory.dmp

Filesize
8KB

Download
memory/1124-56-0x0000000000000000-mapping.dmp

Download