4393c4b17913f958b3adf79ea18815c076cad34d92ef9ee2d52c9203c1ede6e1

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 07:38

Target

4393c4b17913f958b3adf79ea18815c076cad34d92ef9ee2d52c9203c1ede6e1.dll
Size

160KB
MD5

0dbb83f695aa3c1873e9bfd85cc6f007
SHA1

e70b45d4c246fd0250ccd96e3d8e8e2c780962b5
SHA256

4393c4b17913f958b3adf79ea18815c076cad34d92ef9ee2d52c9203c1ede6e1
SHA512

3ee989d1227f4be9bf8ec4819b47cc29dcb232726b9c36068e5627c06ef275a433f5b86460a575993e41873639210cac896c750488598d6a4b3ab0be39d3308f
SSDEEP

3072:xuhE6zRkARcgnS892mMcYmxOHr1u/9av/CO15Y:xuh5RcDk8zlAO/C5

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1984 1692 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1984	1692	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2036 wrote to memory of 1692	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1692	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1692	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1692	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1692	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1692	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1692	2036	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 1984	1692	rundll32.exe	WerFault.exe
PID 1692 wrote to memory of 1984	1692	rundll32.exe	WerFault.exe
PID 1692 wrote to memory of 1984	1692	rundll32.exe	WerFault.exe
PID 1692 wrote to memory of 1984	1692	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4393c4b17913f958b3adf79ea18815c076cad34d92ef9ee2d52c9203c1ede6e1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4393c4b17913f958b3adf79ea18815c076cad34d92ef9ee2d52c9203c1ede6e1.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 272
3⤵
- Program crash
PID:1984

memory/1692-54-0x0000000000000000-mapping.dmp

Download
memory/1692-55-0x0000000076651000-0x0000000076653000-memory.dmp

Filesize
8KB

Download
memory/1984-56-0x0000000000000000-mapping.dmp

Download