a9915cd3f8852f70147824ce5bbb7bfaa53d1c97d2e908e9565bb000bab6d4cc

Analysis

max time kernel
26s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 03:37

Target

a9915cd3f8852f70147824ce5bbb7bfaa53d1c97d2e908e9565bb000bab6d4cc.dll
Size

236KB
MD5

9234ac7786abe337a2feb56ce7d6b7f8
SHA1

ca6458879d9084d15864df179a794fd824414a57
SHA256

a9915cd3f8852f70147824ce5bbb7bfaa53d1c97d2e908e9565bb000bab6d4cc
SHA512

275b9634292d81712a562f3beef9fe158efb1e99cc47780feb8286737c9481c4842d8b121e936d6bb9549b658153d80204af92e1a169ea70f79b732d675ecd61
SSDEEP

3072:Olsq5sd1QeEWuffjReT2sx0SEE95j/KkW/Q4tJerCxB75Ebe8N2Hq/MXeYn3nXnX:S4d1qFKHz6kCL7558N1c6y

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
976	1736	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 1736	1340	rundll32.exe	28
PID 1340 wrote to memory of 1736	1340	rundll32.exe	28
PID 1340 wrote to memory of 1736	1340	rundll32.exe	28
PID 1340 wrote to memory of 1736	1340	rundll32.exe	28
PID 1340 wrote to memory of 1736	1340	rundll32.exe	28
PID 1340 wrote to memory of 1736	1340	rundll32.exe	28
PID 1340 wrote to memory of 1736	1340	rundll32.exe	28
PID 1736 wrote to memory of 976	1736	rundll32.exe	29
PID 1736 wrote to memory of 976	1736	rundll32.exe	29
PID 1736 wrote to memory of 976	1736	rundll32.exe	29
PID 1736 wrote to memory of 976	1736	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9915cd3f8852f70147824ce5bbb7bfaa53d1c97d2e908e9565bb000bab6d4cc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9915cd3f8852f70147824ce5bbb7bfaa53d1c97d2e908e9565bb000bab6d4cc.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 224
    3⤵
    - Program crash
    PID:976

memory/1736-55-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download