8d5b8b4566a9c1c1568315d820d7d48291ea9b4ab5c22f8bdfe83bdfb50de7d9

Analysis

max time kernel
23s
max time network
51s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 12:39

Target

8d5b8b4566a9c1c1568315d820d7d48291ea9b4ab5c22f8bdfe83bdfb50de7d9.dll
Size

893KB
MD5

e9d43a0c8dc37694579b5941cb2d8b67
SHA1

291771fd547d4ba2a72950f1175f33709e90053d
SHA256

8d5b8b4566a9c1c1568315d820d7d48291ea9b4ab5c22f8bdfe83bdfb50de7d9
SHA512

111613b071d1bc7428216f157fc47ecae9b4c4f002dc2fe9e8cde1a1cee84419d49aeb2fbb70b5975e889e6f412a48dd8ea186db6d4c4ada7d34cc28128bbb51
SSDEEP

12288:KFHzYYHaHIU+2pX5niwi7brv84QQTumnzTA7e:uHz7HS+2pI7brv8BQzn3A7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2040	1096	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 1096	1228	rundll32.exe	28
PID 1228 wrote to memory of 1096	1228	rundll32.exe	28
PID 1228 wrote to memory of 1096	1228	rundll32.exe	28
PID 1228 wrote to memory of 1096	1228	rundll32.exe	28
PID 1228 wrote to memory of 1096	1228	rundll32.exe	28
PID 1228 wrote to memory of 1096	1228	rundll32.exe	28
PID 1228 wrote to memory of 1096	1228	rundll32.exe	28
PID 1096 wrote to memory of 2040	1096	rundll32.exe	29
PID 1096 wrote to memory of 2040	1096	rundll32.exe	29
PID 1096 wrote to memory of 2040	1096	rundll32.exe	29
PID 1096 wrote to memory of 2040	1096	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8d5b8b4566a9c1c1568315d820d7d48291ea9b4ab5c22f8bdfe83bdfb50de7d9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8d5b8b4566a9c1c1568315d820d7d48291ea9b4ab5c22f8bdfe83bdfb50de7d9.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 264
    3⤵
    - Program crash
    PID:2040

memory/1096-55-0x0000000075C41000-0x0000000075C43000-memory.dmp

Filesize
8KB

Download