c8ca65f79f7bef034e380881f18b6d21292d0341bf57fecefaa93104920bf19e

Analysis

max time kernel
37s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 19:22

Target

c8ca65f79f7bef034e380881f18b6d21292d0341bf57fecefaa93104920bf19e.dll
Size

414KB
MD5

12e22978fc0af007c622672288356127
SHA1

c2118c143a0de247c7996025bcefa000051767bf
SHA256

c8ca65f79f7bef034e380881f18b6d21292d0341bf57fecefaa93104920bf19e
SHA512

ea5a80fd0bfae6d6a97b59183ddfb8fee71d922fa0a4122b24d16cf554ea300c5a6dfa27ede77162b466e415602b4aa10a8c6fd0417193e394027a07e14fc7e3
SSDEEP

6144:8aqDdbHmLozvSeb/MuIYxPrfS3zALF8ZEn2HVXSZAHGSY1xKbWwVN9Pb0H1dumTq:8JdbHmLozxwAuESy2HBJKCVN9PI1R9

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1684 1940 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1684	1940	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 900 wrote to memory of 1940	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 1940	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 1940	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 1940	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 1940	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 1940	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 1940	900	rundll32.exe	rundll32.exe
PID 1940 wrote to memory of 1684	1940	rundll32.exe	WerFault.exe
PID 1940 wrote to memory of 1684	1940	rundll32.exe	WerFault.exe
PID 1940 wrote to memory of 1684	1940	rundll32.exe	WerFault.exe
PID 1940 wrote to memory of 1684	1940	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c8ca65f79f7bef034e380881f18b6d21292d0341bf57fecefaa93104920bf19e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:900

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c8ca65f79f7bef034e380881f18b6d21292d0341bf57fecefaa93104920bf19e.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 256
3⤵
- Program crash
PID:1684

memory/1684-61-0x0000000000000000-mapping.dmp

Download
memory/1940-54-0x0000000000000000-mapping.dmp

Download
memory/1940-55-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download
memory/1940-56-0x00000000006D0000-0x000000000072E000-memory.dmp

Filesize
376KB

Download
memory/1940-57-0x00000000007C0000-0x000000000082B000-memory.dmp

Filesize
428KB

Download
memory/1940-62-0x00000000006D0000-0x000000000072E000-memory.dmp

Filesize
376KB

Download