84bf45af5a15adc9a4fc44ba6a39424410c5ab232e87e65a852687ae0e4546c3

Analysis

max time kernel
38s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 06:36

Target

84bf45af5a15adc9a4fc44ba6a39424410c5ab232e87e65a852687ae0e4546c3.dll
Size

19KB
MD5

98e92ec7728d6660abd6c53742546f01
SHA1

9b26224d65637da50802a4f76ecabe0821c1980a
SHA256

84bf45af5a15adc9a4fc44ba6a39424410c5ab232e87e65a852687ae0e4546c3
SHA512

5f70d56dc91dde0507451f956fdec839a6276a7521bced3c1da434b1364864c424c9310b5e3e588bd091c9e35172fbe4f5df4d20e8d7ff540e59c2192d8dcf09
SSDEEP

192:6NcOEzFXCnKz+IKnGWO1f0aoR7x+sBWtn9NyBOC092cKfjcR0BcPG6s1bT:6NMzQjHnG/oRlTY5tC0ocEjU0Bcts1T

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

860 1120 WerFault.exe rundll32.exe

pid	pid_target	process	target process
860	1120	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1248 wrote to memory of 1120	1248	rundll32.exe	rundll32.exe
PID 1248 wrote to memory of 1120	1248	rundll32.exe	rundll32.exe
PID 1248 wrote to memory of 1120	1248	rundll32.exe	rundll32.exe
PID 1248 wrote to memory of 1120	1248	rundll32.exe	rundll32.exe
PID 1248 wrote to memory of 1120	1248	rundll32.exe	rundll32.exe
PID 1248 wrote to memory of 1120	1248	rundll32.exe	rundll32.exe
PID 1248 wrote to memory of 1120	1248	rundll32.exe	rundll32.exe
PID 1120 wrote to memory of 860	1120	rundll32.exe	WerFault.exe
PID 1120 wrote to memory of 860	1120	rundll32.exe	WerFault.exe
PID 1120 wrote to memory of 860	1120	rundll32.exe	WerFault.exe
PID 1120 wrote to memory of 860	1120	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\84bf45af5a15adc9a4fc44ba6a39424410c5ab232e87e65a852687ae0e4546c3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1248

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\84bf45af5a15adc9a4fc44ba6a39424410c5ab232e87e65a852687ae0e4546c3.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 224
3⤵
- Program crash
PID:860

memory/860-56-0x0000000000000000-mapping.dmp

Download
memory/1120-54-0x0000000000000000-mapping.dmp

Download
memory/1120-55-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download