6436f04f508b2c3940c9efd556755880845312025fa0079b5019661bb8c03f6c

Analysis

max time kernel
1s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 02:49

Target

6436f04f508b2c3940c9efd556755880845312025fa0079b5019661bb8c03f6c.dll
Size

28KB
MD5

2243e6d6652c06f40bd002128c35a957
SHA1

0029a797d363656ced0b0ead36baf00b2241c01f
SHA256

6436f04f508b2c3940c9efd556755880845312025fa0079b5019661bb8c03f6c
SHA512

0f08874eb2ec6c6544620c465e7b84a16812c8de93159df5b413afa9d3921b9f6c7dceb580fe4c76fc4500b1956e4504b0a46b64b98bc1ba13540cf545be384e
SSDEEP

192:1UDNYUwVUpkZwgWumGjUNUF4v91tQtKqpqSqq5kfQ2wqpqSqqcE:12YUOhaOU+y91tQt5ASZ5kfQ2jASZcE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
296	1344	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 1344	940	rundll32.exe	28
PID 940 wrote to memory of 1344	940	rundll32.exe	28
PID 940 wrote to memory of 1344	940	rundll32.exe	28
PID 940 wrote to memory of 1344	940	rundll32.exe	28
PID 940 wrote to memory of 1344	940	rundll32.exe	28
PID 940 wrote to memory of 1344	940	rundll32.exe	28
PID 940 wrote to memory of 1344	940	rundll32.exe	28
PID 1344 wrote to memory of 296	1344	rundll32.exe	29
PID 1344 wrote to memory of 296	1344	rundll32.exe	29
PID 1344 wrote to memory of 296	1344	rundll32.exe	29
PID 1344 wrote to memory of 296	1344	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6436f04f508b2c3940c9efd556755880845312025fa0079b5019661bb8c03f6c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6436f04f508b2c3940c9efd556755880845312025fa0079b5019661bb8c03f6c.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 252
    3⤵
    - Program crash
    PID:296

memory/1344-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download