83ba8419c25cfce67f5b41d27f449864fcb89a557e4c71925b63aa05dc279ba8

Analysis

max time kernel
34s
max time network
106s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 06:43

Target

83ba8419c25cfce67f5b41d27f449864fcb89a557e4c71925b63aa05dc279ba8.dll
Size

32KB
MD5

7f6f2b7656c69b7587539f33e37e2280
SHA1

9d9bcfaa5ec2ef2e854a8c044397c2c146b6a6b8
SHA256

83ba8419c25cfce67f5b41d27f449864fcb89a557e4c71925b63aa05dc279ba8
SHA512

6ea5535c2343332c9bb176db41eae9cc1ceff479ee2ff841a15534568eb8684941d043089a8c1f8614cb20cdfc0339a8645525ddb820ae279c1b686597c8cb20
SSDEEP

384:i/pJuzg3dzNCo5Gi2a5V1dZgeQqghAEc9F+tnu6EDHJIg1/NC3vU2ZEq8A2L9U:iLu85nZd+e/gh0OnTEDo3vUsCU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1324	1476	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1476	1096	rundll32.exe	26
PID 1096 wrote to memory of 1476	1096	rundll32.exe	26
PID 1096 wrote to memory of 1476	1096	rundll32.exe	26
PID 1096 wrote to memory of 1476	1096	rundll32.exe	26
PID 1096 wrote to memory of 1476	1096	rundll32.exe	26
PID 1096 wrote to memory of 1476	1096	rundll32.exe	26
PID 1096 wrote to memory of 1476	1096	rundll32.exe	26
PID 1476 wrote to memory of 1324	1476	rundll32.exe	27
PID 1476 wrote to memory of 1324	1476	rundll32.exe	27
PID 1476 wrote to memory of 1324	1476	rundll32.exe	27
PID 1476 wrote to memory of 1324	1476	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\83ba8419c25cfce67f5b41d27f449864fcb89a557e4c71925b63aa05dc279ba8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\83ba8419c25cfce67f5b41d27f449864fcb89a557e4c71925b63aa05dc279ba8.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 228
    3⤵
    - Program crash
    PID:1324

memory/1476-55-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download