d1892f30dd76213ff167a4e9a55e91368d637427b88e0a2dec712d0db89abceb

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 04:20

Target

d1892f30dd76213ff167a4e9a55e91368d637427b88e0a2dec712d0db89abceb.dll
Size

175KB
MD5

82533136747274e5b377c72ace5b0cf5
SHA1

f87a4c1b00159981a020f014210af6716df86078
SHA256

d1892f30dd76213ff167a4e9a55e91368d637427b88e0a2dec712d0db89abceb
SHA512

3ba4401d38ea933fa0db25d6cef7f812a4787789253237edd9a480413dfa49937cfe516fe625a9f28c3131a2972508d7d77a0233becbc86d938047a0129bb730
SSDEEP

3072:OQo/r4QiTG8/IuNlspCQKk9mpobZQyH8oz5EiMWbgPb/+ohLd:Do/r378wcApKobKQ8Kl9gPhL

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

912 1112 WerFault.exe rundll32.exe

pid	pid_target	process	target process
912	1112	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1768 wrote to memory of 1112	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 1112	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 1112	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 1112	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 1112	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 1112	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 1112	1768	rundll32.exe	rundll32.exe
PID 1112 wrote to memory of 912	1112	rundll32.exe	WerFault.exe
PID 1112 wrote to memory of 912	1112	rundll32.exe	WerFault.exe
PID 1112 wrote to memory of 912	1112	rundll32.exe	WerFault.exe
PID 1112 wrote to memory of 912	1112	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d1892f30dd76213ff167a4e9a55e91368d637427b88e0a2dec712d0db89abceb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1768

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d1892f30dd76213ff167a4e9a55e91368d637427b88e0a2dec712d0db89abceb.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 224
3⤵
- Program crash
PID:912

memory/912-56-0x0000000000000000-mapping.dmp

Download
memory/1112-54-0x0000000000000000-mapping.dmp

Download
memory/1112-55-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download