ad0a858b676cde7b617db1832c5be47fbe650ef23f7ed00d028daa0f1179b30f

Analysis

max time kernel
43s
max time network
38s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 22:57

Target

KEYMAKE/INCLUDE/MSPDB50.dll
Size

153KB
MD5

97f4325565d19f5d08e24c32464eb073
SHA1

97829e0a61fac69b42cbf64dd8e640cd9941c78b
SHA256

f3b6fd55b6d7816156b414931428bdcdcd8e8861e1be00e331bccdf7d35d10ba
SHA512

7ae31fa198ffceda21b68dd3a070147a618aa7ed6bc95213c8417d09c48c65da22fb43831edf80ef350bc8347fc3d2ecf417cd0f7a588500b6b140e55e0ae1f6
SSDEEP

3072:n17UDgOV9UkTRtA5kLh27sAcjXjB9aKxbPsWDQe/KFW:nx8ea6kf3iKlsaQW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1340	556	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 556	564	rundll32.exe	28
PID 564 wrote to memory of 556	564	rundll32.exe	28
PID 564 wrote to memory of 556	564	rundll32.exe	28
PID 564 wrote to memory of 556	564	rundll32.exe	28
PID 564 wrote to memory of 556	564	rundll32.exe	28
PID 564 wrote to memory of 556	564	rundll32.exe	28
PID 564 wrote to memory of 556	564	rundll32.exe	28
PID 556 wrote to memory of 1340	556	rundll32.exe	29
PID 556 wrote to memory of 1340	556	rundll32.exe	29
PID 556 wrote to memory of 1340	556	rundll32.exe	29
PID 556 wrote to memory of 1340	556	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\KEYMAKE\INCLUDE\MSPDB50.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\KEYMAKE\INCLUDE\MSPDB50.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:556
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 240
    3⤵
    - Program crash
    PID:1340

memory/556-55-0x0000000075511000-0x0000000075513000-memory.dmp

Filesize
8KB

Download