d3197dd9aec8f204f12ac85207ee1df2a6693b6c217a3d74ccbcb3098916ebe6

Resubmissions

24-11-2022 15:37

24-11-2022 10:52

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 10:52

Target

d3197dd9aec8f204f12ac85207ee1df2a6693b6c217a3d74ccbcb3098916ebe6.dll
Size

60KB
MD5

3c4bd5309143853848381c9eb0435d75
SHA1

ebc1cbd8e5ceaff0dd941fd044d106997eba846f
SHA256

d3197dd9aec8f204f12ac85207ee1df2a6693b6c217a3d74ccbcb3098916ebe6
SHA512

2455a862cfd69f7879d869de2aad43797aa81ff10cd9e81b11705185b2517d4b751871c096568714c48aca25bbf1b414b66ef7f82eb8fa35ee458d511c3c543e
SSDEEP

768:Uc6gRL3cpsKBRkdeVyg7ifaU1rz9oDc0kT2w3P5WKpQlORX7UmZ:UlaL3cpnR1ApLCDcz3PNBRX73

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1084 1168 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1084	1168	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1832 wrote to memory of 1168	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1168	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1168	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1168	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1168	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1168	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1168	1832	rundll32.exe	rundll32.exe
PID 1168 wrote to memory of 1084	1168	rundll32.exe	WerFault.exe
PID 1168 wrote to memory of 1084	1168	rundll32.exe	WerFault.exe
PID 1168 wrote to memory of 1084	1168	rundll32.exe	WerFault.exe
PID 1168 wrote to memory of 1084	1168	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3197dd9aec8f204f12ac85207ee1df2a6693b6c217a3d74ccbcb3098916ebe6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3197dd9aec8f204f12ac85207ee1df2a6693b6c217a3d74ccbcb3098916ebe6.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1168
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 268
    3⤵
    - Program crash
    PID:1084

memory/1084-56-0x0000000000000000-mapping.dmp

Download
memory/1168-54-0x0000000000000000-mapping.dmp

Download
memory/1168-55-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download