3534f12fed91ca8377ff9b2b658301d0b5916e4d27a3959f2066d52dd3ab2f4b

Analysis

max time kernel
235s
max time network
332s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 19:53

Target

3534f12fed91ca8377ff9b2b658301d0b5916e4d27a3959f2066d52dd3ab2f4b.dll
Size

37KB
MD5

a8ca459be11daf988272ac5c26cf1d7c
SHA1

7d859138321dc206db3cb110b3d082ba7541abda
SHA256

3534f12fed91ca8377ff9b2b658301d0b5916e4d27a3959f2066d52dd3ab2f4b
SHA512

2181dcf09c944065f495ac8761374f31e079d54be2cca90b43be7f359d5b4cc7f805b20eb067891dd1096e2fefeef512bd7fe78e11bf1edb529cb9971348bfcf
SSDEEP

768:6iLj7ADRiYLbpV8xHv+ouGSV2XLyYhlPVHObJgu9TJ4:PHHYLr8mPGnLZFu2u9TJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1156	1480	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 1480	1044	rundll32.exe	28
PID 1044 wrote to memory of 1480	1044	rundll32.exe	28
PID 1044 wrote to memory of 1480	1044	rundll32.exe	28
PID 1044 wrote to memory of 1480	1044	rundll32.exe	28
PID 1044 wrote to memory of 1480	1044	rundll32.exe	28
PID 1044 wrote to memory of 1480	1044	rundll32.exe	28
PID 1044 wrote to memory of 1480	1044	rundll32.exe	28
PID 1480 wrote to memory of 1156	1480	rundll32.exe	29
PID 1480 wrote to memory of 1156	1480	rundll32.exe	29
PID 1480 wrote to memory of 1156	1480	rundll32.exe	29
PID 1480 wrote to memory of 1156	1480	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3534f12fed91ca8377ff9b2b658301d0b5916e4d27a3959f2066d52dd3ab2f4b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3534f12fed91ca8377ff9b2b658301d0b5916e4d27a3959f2066d52dd3ab2f4b.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 228
    3⤵
    - Program crash
    PID:1156

memory/1480-55-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download