90e72aed1551c971ac2af83da85019526db21b4790747ca5375301e0a5f4d595

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 06:58

Target

90e72aed1551c971ac2af83da85019526db21b4790747ca5375301e0a5f4d595.dll
Size

52KB
MD5

e1de872577a0013a4af27e1cc38a3d61
SHA1

29ee96d3a8dba4a5eeb14784f27fd2f3577d1899
SHA256

90e72aed1551c971ac2af83da85019526db21b4790747ca5375301e0a5f4d595
SHA512

c1540b2ab3fd866fc943efbe9f8bd094571b726afb35389711e840a3246b99cf093e8b5ae99931bf750ec66d27cbe3ee60fb7ec9490e30a84dcbd38122b374a3
SSDEEP

1536:Vho2LppRlp7HBCHEWEXgA8vHgT7lbRmt9sBxsXK6eUIBEAE:7ochCHEjXNMHGdgt9EiXeEAE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1920	872	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 872	1440	rundll32.exe	28
PID 1440 wrote to memory of 872	1440	rundll32.exe	28
PID 1440 wrote to memory of 872	1440	rundll32.exe	28
PID 1440 wrote to memory of 872	1440	rundll32.exe	28
PID 1440 wrote to memory of 872	1440	rundll32.exe	28
PID 1440 wrote to memory of 872	1440	rundll32.exe	28
PID 1440 wrote to memory of 872	1440	rundll32.exe	28
PID 872 wrote to memory of 1920	872	rundll32.exe	29
PID 872 wrote to memory of 1920	872	rundll32.exe	29
PID 872 wrote to memory of 1920	872	rundll32.exe	29
PID 872 wrote to memory of 1920	872	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\90e72aed1551c971ac2af83da85019526db21b4790747ca5375301e0a5f4d595.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\90e72aed1551c971ac2af83da85019526db21b4790747ca5375301e0a5f4d595.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 232
    3⤵
    - Program crash
    PID:1920

memory/872-55-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/872-56-0x0000000010000000-0x0000000010044000-memory.dmp

Filesize
272KB

Download
memory/872-58-0x0000000010000000-0x0000000010044000-memory.dmp

Filesize
272KB

Download