2c2aec3cce6d7f52ba68d7d522d2cbf963022f4e37e99565b6ca4b66391d538e

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 03:45

Target

2c2aec3cce6d7f52ba68d7d522d2cbf963022f4e37e99565b6ca4b66391d538e.dll
Size

40KB
MD5

04ad2f840c851b1e0406e0dc6e25ab13
SHA1

ca5a3a4f956a5e922f9433176ea4c9f2985a7ed7
SHA256

2c2aec3cce6d7f52ba68d7d522d2cbf963022f4e37e99565b6ca4b66391d538e
SHA512

05c423e07b7fb965461baa431ce793d233eac8cb45eb138980dc68aea26f45add3e029b5e5813928d82522943cc8094a98ea7f39c9e93881d9a161bbedcb5435
SSDEEP

768:pmQUF/aAwza16AawBbmtSAi6VpjnbKI9aAQOKTl54rP3BkS:pAaJW1E+6TjnbKIAAQOKTl54rP3

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1628 1652 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1628	1652	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 704 wrote to memory of 1652	704	rundll32.exe	rundll32.exe
PID 704 wrote to memory of 1652	704	rundll32.exe	rundll32.exe
PID 704 wrote to memory of 1652	704	rundll32.exe	rundll32.exe
PID 704 wrote to memory of 1652	704	rundll32.exe	rundll32.exe
PID 704 wrote to memory of 1652	704	rundll32.exe	rundll32.exe
PID 704 wrote to memory of 1652	704	rundll32.exe	rundll32.exe
PID 704 wrote to memory of 1652	704	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1628	1652	rundll32.exe	WerFault.exe
PID 1652 wrote to memory of 1628	1652	rundll32.exe	WerFault.exe
PID 1652 wrote to memory of 1628	1652	rundll32.exe	WerFault.exe
PID 1652 wrote to memory of 1628	1652	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c2aec3cce6d7f52ba68d7d522d2cbf963022f4e37e99565b6ca4b66391d538e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:704

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c2aec3cce6d7f52ba68d7d522d2cbf963022f4e37e99565b6ca4b66391d538e.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 236
3⤵
- Program crash
PID:1628

memory/1628-56-0x0000000000000000-mapping.dmp

Download
memory/1652-54-0x0000000000000000-mapping.dmp

Download
memory/1652-55-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

Filesize
8KB

Download