cd905fdfa5b7b1491e0e1b0b2c456884eca312dca12012b0a6b835e520a674c1

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 01:08

Target

cd905fdfa5b7b1491e0e1b0b2c456884eca312dca12012b0a6b835e520a674c1.dll
Size

160KB
MD5

32bf3157e9ffff2a641fff74a288c1e0
SHA1

60dd6511102ec73f3c4cd4d1deb87fe2d14f28ce
SHA256

cd905fdfa5b7b1491e0e1b0b2c456884eca312dca12012b0a6b835e520a674c1
SHA512

d53d2250a61e36a54d1bab64086f77e1b8684cfd622cb4dd4bec891708392a21e42591f3704468efaaedc19a99697d8ff1401bd819572481a74607bbfef05bdc
SSDEEP

3072:APRtOWPa+9yuVWRaS2Y8qoQoRvTFaJ/c4w91MTAc5RTAqce:IRtra+XrSR8DZTsP1TA2Rx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1004	1884	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 1884	780	rundll32.exe	28
PID 780 wrote to memory of 1884	780	rundll32.exe	28
PID 780 wrote to memory of 1884	780	rundll32.exe	28
PID 780 wrote to memory of 1884	780	rundll32.exe	28
PID 780 wrote to memory of 1884	780	rundll32.exe	28
PID 780 wrote to memory of 1884	780	rundll32.exe	28
PID 780 wrote to memory of 1884	780	rundll32.exe	28
PID 1884 wrote to memory of 1004	1884	rundll32.exe	29
PID 1884 wrote to memory of 1004	1884	rundll32.exe	29
PID 1884 wrote to memory of 1004	1884	rundll32.exe	29
PID 1884 wrote to memory of 1004	1884	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cd905fdfa5b7b1491e0e1b0b2c456884eca312dca12012b0a6b835e520a674c1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cd905fdfa5b7b1491e0e1b0b2c456884eca312dca12012b0a6b835e520a674c1.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 240
    3⤵
    - Program crash
    PID:1004

memory/1004-56-0x0000000000000000-mapping.dmp

Download
memory/1884-54-0x0000000000000000-mapping.dmp

Download
memory/1884-55-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download
memory/1884-57-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download
memory/1884-58-0x0000000000100000-0x000000000010F000-memory.dmp

Filesize
60KB

Download
memory/1884-59-0x0000000000110000-0x000000000011F000-memory.dmp

Filesize
60KB

Download