6da7ddbd7007d59112794b2829fee34f6c1edfa23ff604f1b7e02fb260be9c1e

Analysis

max time kernel
75s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 09:54

Target

6da7ddbd7007d59112794b2829fee34f6c1edfa23ff604f1b7e02fb260be9c1e.dll
Size

31KB
MD5

6da6ddc96ef4146a9f9dbadda78228d9
SHA1

ed0828aedb13ee00ed8d7354554462facaad060b
SHA256

6da7ddbd7007d59112794b2829fee34f6c1edfa23ff604f1b7e02fb260be9c1e
SHA512

9a0076adb23132402b59f0b9e8779c8c03bc2ed3fe48e10691df26d4905039eb4ad6ee224b9c22971d1a8397e157eec24d7dafd058eb0a9ed4593a7b7f6447a0
SSDEEP

192:sSNckBnqi46trQt5JO/uRyVUhfDIdvKinYe+PjPHrozBmF8+v8LjtlAur9ZCspEv:Dz46BQROyDfDISinYPLi8AHUHeMG3sL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1864	928	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 928	1516	rundll32.exe	28
PID 1516 wrote to memory of 928	1516	rundll32.exe	28
PID 1516 wrote to memory of 928	1516	rundll32.exe	28
PID 1516 wrote to memory of 928	1516	rundll32.exe	28
PID 1516 wrote to memory of 928	1516	rundll32.exe	28
PID 1516 wrote to memory of 928	1516	rundll32.exe	28
PID 1516 wrote to memory of 928	1516	rundll32.exe	28
PID 928 wrote to memory of 1864	928	rundll32.exe	29
PID 928 wrote to memory of 1864	928	rundll32.exe	29
PID 928 wrote to memory of 1864	928	rundll32.exe	29
PID 928 wrote to memory of 1864	928	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6da7ddbd7007d59112794b2829fee34f6c1edfa23ff604f1b7e02fb260be9c1e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6da7ddbd7007d59112794b2829fee34f6c1edfa23ff604f1b7e02fb260be9c1e.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 228
    3⤵
    - Program crash
    PID:1864

memory/928-55-0x0000000076931000-0x0000000076933000-memory.dmp

Filesize
8KB

Download