84615527f12a88f04a682a3e9bad2d68cd1cf3233c60a9bf4a1a530bcceb85a2

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 06:39

Target

84615527f12a88f04a682a3e9bad2d68cd1cf3233c60a9bf4a1a530bcceb85a2.dll
Size

4KB
MD5

d47d7f49f399637a39e029ca74253468
SHA1

2973c68e7878210b9d9abc17c7b639f4dd6bf968
SHA256

84615527f12a88f04a682a3e9bad2d68cd1cf3233c60a9bf4a1a530bcceb85a2
SHA512

b0c27afda01bdc1b6bdef0848ac67572aeb72365d683333ff865ee749beb539a05c3c7116bec1d3ed777418e7234e921aae8efb2a1f42c7d5c40ae46fc980df6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1220	1076	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 1076	864	rundll32.exe	27
PID 864 wrote to memory of 1076	864	rundll32.exe	27
PID 864 wrote to memory of 1076	864	rundll32.exe	27
PID 864 wrote to memory of 1076	864	rundll32.exe	27
PID 864 wrote to memory of 1076	864	rundll32.exe	27
PID 864 wrote to memory of 1076	864	rundll32.exe	27
PID 864 wrote to memory of 1076	864	rundll32.exe	27
PID 1076 wrote to memory of 1220	1076	rundll32.exe	28
PID 1076 wrote to memory of 1220	1076	rundll32.exe	28
PID 1076 wrote to memory of 1220	1076	rundll32.exe	28
PID 1076 wrote to memory of 1220	1076	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\84615527f12a88f04a682a3e9bad2d68cd1cf3233c60a9bf4a1a530bcceb85a2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\84615527f12a88f04a682a3e9bad2d68cd1cf3233c60a9bf4a1a530bcceb85a2.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 228
    3⤵
    - Program crash
    PID:1220

memory/1076-55-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/1076-57-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download