778a9ec07ff714bbb8308c64edbad39aeb33a1df2f4b744c4edde7f713b40e8b

Analysis

max time kernel
23s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 07:32

Target

778a9ec07ff714bbb8308c64edbad39aeb33a1df2f4b744c4edde7f713b40e8b.dll
Size

732KB
MD5

60c38dfe02eed18ac1b7d816ac589880
SHA1

ab87ea27c7af0abc58d44394447d5fb16245fa0a
SHA256

778a9ec07ff714bbb8308c64edbad39aeb33a1df2f4b744c4edde7f713b40e8b
SHA512

6c71c4b5a7c9955839586e05db64a4c3f829213313058d6d9c91eabb22e66cbf60e7c5a33d4633e5f7bb251c3b0062eb3091282f69a0659a837b3cf8b49447cd
SSDEEP

12288:Ym5AaXarjQGY+JKH1h7735H3NSJzQskduZL/pYpLYw8DvG:YAAuaA+odH9WeyONGvG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
848	1212	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 1212	1004	rundll32.exe	28
PID 1004 wrote to memory of 1212	1004	rundll32.exe	28
PID 1004 wrote to memory of 1212	1004	rundll32.exe	28
PID 1004 wrote to memory of 1212	1004	rundll32.exe	28
PID 1004 wrote to memory of 1212	1004	rundll32.exe	28
PID 1004 wrote to memory of 1212	1004	rundll32.exe	28
PID 1004 wrote to memory of 1212	1004	rundll32.exe	28
PID 1212 wrote to memory of 848	1212	rundll32.exe	29
PID 1212 wrote to memory of 848	1212	rundll32.exe	29
PID 1212 wrote to memory of 848	1212	rundll32.exe	29
PID 1212 wrote to memory of 848	1212	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\778a9ec07ff714bbb8308c64edbad39aeb33a1df2f4b744c4edde7f713b40e8b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\778a9ec07ff714bbb8308c64edbad39aeb33a1df2f4b744c4edde7f713b40e8b.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 232
    3⤵
    - Program crash
    PID:848

memory/1212-55-0x0000000075211000-0x0000000075213000-memory.dmp

Filesize
8KB

Download
memory/1212-56-0x0000000001D00000-0x0000000001DB7000-memory.dmp

Filesize
732KB

Download
memory/1212-61-0x0000000000210000-0x0000000000293000-memory.dmp

Filesize
524KB

Download