56917fc6f5b99b54588711956aad2e92f0fcfd44b3224a72399c5d259d924c0a

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 12:39

Target

56917fc6f5b99b54588711956aad2e92f0fcfd44b3224a72399c5d259d924c0a.dll
Size

382KB
MD5

b705ade3168fbee22dabcf90742115a7
SHA1

364ab05505f150289430c843e1dc042b9fb19008
SHA256

56917fc6f5b99b54588711956aad2e92f0fcfd44b3224a72399c5d259d924c0a
SHA512

1c65636154906cff57a898dd559d069d6ba9f0f5dbacbf52d59cd60929d5465bb5d3d302179c9a6c29a7b49eb3df6aadf900da520dfa44e64bf04044456a9b61
SSDEEP

6144:Cez9ysukv32tEjncMOwc3uttEgTZlgwe98GU688daI8Bzx:79ysuklcyc34x88GUnScBzx

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1104 856 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1104	856	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1196 wrote to memory of 856	1196	rundll32.exe	rundll32.exe
PID 1196 wrote to memory of 856	1196	rundll32.exe	rundll32.exe
PID 1196 wrote to memory of 856	1196	rundll32.exe	rundll32.exe
PID 1196 wrote to memory of 856	1196	rundll32.exe	rundll32.exe
PID 1196 wrote to memory of 856	1196	rundll32.exe	rundll32.exe
PID 1196 wrote to memory of 856	1196	rundll32.exe	rundll32.exe
PID 1196 wrote to memory of 856	1196	rundll32.exe	rundll32.exe
PID 856 wrote to memory of 1104	856	rundll32.exe	WerFault.exe
PID 856 wrote to memory of 1104	856	rundll32.exe	WerFault.exe
PID 856 wrote to memory of 1104	856	rundll32.exe	WerFault.exe
PID 856 wrote to memory of 1104	856	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\56917fc6f5b99b54588711956aad2e92f0fcfd44b3224a72399c5d259d924c0a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1196

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\56917fc6f5b99b54588711956aad2e92f0fcfd44b3224a72399c5d259d924c0a.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 220
3⤵
- Program crash
PID:1104

memory/856-54-0x0000000000000000-mapping.dmp

Download
memory/856-55-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1104-56-0x0000000000000000-mapping.dmp

Download