fc5546697181afdbd45429f2cbaaa0bf951475b0a6cb1b6f9d7700db431660f9

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 04:09

Target

fc5546697181afdbd45429f2cbaaa0bf951475b0a6cb1b6f9d7700db431660f9.dll
Size

527KB
MD5

d8b2bf53c0d20bd89f1f69a75e0b190c
SHA1

204c53bf069087b82314f2b24e4bd49d6379ae27
SHA256

fc5546697181afdbd45429f2cbaaa0bf951475b0a6cb1b6f9d7700db431660f9
SHA512

650595998f4f161215941db09bd0ac58b10b5d11132b8b27e327ff5e334ade723c2e75ae516d50708c02bc4ff108e061b94a0c40aa57c6ea2634ba53a59970e6
SSDEEP

12288:1SZFvpsLfoJm6K81I3WHPjUUQvs1kWmu7:KFvpsL8RK8cWLUUQE1xm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
952	1712	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 1712	1208	rundll32.exe	28
PID 1208 wrote to memory of 1712	1208	rundll32.exe	28
PID 1208 wrote to memory of 1712	1208	rundll32.exe	28
PID 1208 wrote to memory of 1712	1208	rundll32.exe	28
PID 1208 wrote to memory of 1712	1208	rundll32.exe	28
PID 1208 wrote to memory of 1712	1208	rundll32.exe	28
PID 1208 wrote to memory of 1712	1208	rundll32.exe	28
PID 1712 wrote to memory of 952	1712	rundll32.exe	29
PID 1712 wrote to memory of 952	1712	rundll32.exe	29
PID 1712 wrote to memory of 952	1712	rundll32.exe	29
PID 1712 wrote to memory of 952	1712	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc5546697181afdbd45429f2cbaaa0bf951475b0a6cb1b6f9d7700db431660f9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc5546697181afdbd45429f2cbaaa0bf951475b0a6cb1b6f9d7700db431660f9.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 256
    3⤵
    - Program crash
    PID:952

memory/1712-55-0x0000000075591000-0x0000000075593000-memory.dmp

Filesize
8KB

Download
memory/1712-56-0x0000000000350000-0x00000000003D7000-memory.dmp

Filesize
540KB

Download
memory/1712-61-0x0000000000290000-0x000000000030B000-memory.dmp

Filesize
492KB

Download