8508eddbd5be50a5f06b5533271aee0e1e01050b1f23269b2345f6d05dabac44

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 06:34

Target

8508eddbd5be50a5f06b5533271aee0e1e01050b1f23269b2345f6d05dabac44.dll
Size

9KB
MD5

1ab40fb5f24344d818afd4f2872555eb
SHA1

445fe37705d74e43747b1188f4ec85ce3a6ff7af
SHA256

8508eddbd5be50a5f06b5533271aee0e1e01050b1f23269b2345f6d05dabac44
SHA512

3d81588b5a5d4ccb86112cacb3493234f4a234c03723a276af0bdf626343f2eeb4db784e5043cf88bd7fa457dda7e1a52b90b6f4cad313ece5df1588be1d633b
SSDEEP

192:WNo5kmXmEEnkITKoUBQIEtNvokhF5hDJtKfnv23qJthDN:g1mWEHI2oT7Nh9Dqv6qJtN

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

908 780 WerFault.exe rundll32.exe

pid	pid_target	process	target process
908	780	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1800 wrote to memory of 780	1800	rundll32.exe	rundll32.exe
PID 1800 wrote to memory of 780	1800	rundll32.exe	rundll32.exe
PID 1800 wrote to memory of 780	1800	rundll32.exe	rundll32.exe
PID 1800 wrote to memory of 780	1800	rundll32.exe	rundll32.exe
PID 1800 wrote to memory of 780	1800	rundll32.exe	rundll32.exe
PID 1800 wrote to memory of 780	1800	rundll32.exe	rundll32.exe
PID 1800 wrote to memory of 780	1800	rundll32.exe	rundll32.exe
PID 780 wrote to memory of 908	780	rundll32.exe	WerFault.exe
PID 780 wrote to memory of 908	780	rundll32.exe	WerFault.exe
PID 780 wrote to memory of 908	780	rundll32.exe	WerFault.exe
PID 780 wrote to memory of 908	780	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8508eddbd5be50a5f06b5533271aee0e1e01050b1f23269b2345f6d05dabac44.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1800

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8508eddbd5be50a5f06b5533271aee0e1e01050b1f23269b2345f6d05dabac44.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 236
3⤵
- Program crash
PID:908

memory/780-54-0x0000000000000000-mapping.dmp

Download
memory/780-55-0x00000000758C1000-0x00000000758C3000-memory.dmp

Filesize
8KB

Download
memory/780-57-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/908-56-0x0000000000000000-mapping.dmp

Download