cc206678c5c43b699f57048b992de42118f8c750e88d48ad2d6014e0b5b1c03b

Analysis

max time kernel
3s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26/11/2022, 22:47

Target

cc206678c5c43b699f57048b992de42118f8c750e88d48ad2d6014e0b5b1c03b.dll
Size

144KB
MD5

791b561958cad0eceb4ff010c383d0b3
SHA1

70b299e720293638c24309a5c9c3a09c3e55dfda
SHA256

cc206678c5c43b699f57048b992de42118f8c750e88d48ad2d6014e0b5b1c03b
SHA512

a268517452493979762795841ab4b0838f9d6fd6402978698c12dd7a386d24ebf11d3758091cd95718a79735b59b074952a86f79e8c44dc5bedcbd4b2243ce69
SSDEEP

3072:mxW8Dr5Dkyq6SPTZunOoyWyY9pm/WQNK:b8hk6SPTqXyWyCL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
940	1812	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 940	1812	rundll32.exe	28
PID 1812 wrote to memory of 940	1812	rundll32.exe	28
PID 1812 wrote to memory of 940	1812	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc206678c5c43b699f57048b992de42118f8c750e88d48ad2d6014e0b5b1c03b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1812 -s 140
  2⤵
  - Program crash
  PID:940