2bd2f4a37abc3996a709a53f3bf9058d42d19602392c8f7c05dd96b3bf325e19

Analysis

max time kernel
168s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 10:08

Target

2bd2f4a37abc3996a709a53f3bf9058d42d19602392c8f7c05dd96b3bf325e19.dll
Size

88KB
MD5

c094a63fe440e3f1bdedeb67a205b140
SHA1

5759a6a41edaed845b20e11a78d4124ba806cab9
SHA256

2bd2f4a37abc3996a709a53f3bf9058d42d19602392c8f7c05dd96b3bf325e19
SHA512

1b777a4cb867ad44a4f2b28029b013c3251b1f6a2ab3abb1078c2dcdc2dad5bc395e85c87d06c3f712ae6ecc25bb6aeb872709042999ad7657cca28a70d78ecf
SSDEEP

1536:F3ETstzWmNGYsDW6oH4/s91CnhQ7XTZdN+LVtwVmdJl9Ygmo/HhzvVrh+y:f3BsDOzKnC7jZangS9YkHhzpUy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
584	1376	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1376	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1376	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 1376	1144	rundll32.exe	28
PID 1144 wrote to memory of 1376	1144	rundll32.exe	28
PID 1144 wrote to memory of 1376	1144	rundll32.exe	28
PID 1144 wrote to memory of 1376	1144	rundll32.exe	28
PID 1144 wrote to memory of 1376	1144	rundll32.exe	28
PID 1144 wrote to memory of 1376	1144	rundll32.exe	28
PID 1144 wrote to memory of 1376	1144	rundll32.exe	28
PID 1376 wrote to memory of 584	1376	rundll32.exe	29
PID 1376 wrote to memory of 584	1376	rundll32.exe	29
PID 1376 wrote to memory of 584	1376	rundll32.exe	29
PID 1376 wrote to memory of 584	1376	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bd2f4a37abc3996a709a53f3bf9058d42d19602392c8f7c05dd96b3bf325e19.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bd2f4a37abc3996a709a53f3bf9058d42d19602392c8f7c05dd96b3bf325e19.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 240
    3⤵
    - Program crash
    PID:584

memory/1376-55-0x0000000075881000-0x0000000075883000-memory.dmp

Filesize
8KB

Download
memory/1376-56-0x0000000000220000-0x0000000000234000-memory.dmp

Filesize
80KB

Download
memory/1376-60-0x00000000000A0000-0x00000000000BA000-memory.dmp

Filesize
104KB

Download
memory/1376-61-0x0000000000100000-0x000000000011A000-memory.dmp

Filesize
104KB

Download
memory/1376-59-0x00000000000A0000-0x00000000000BA000-memory.dmp

Filesize
104KB

Download
memory/1376-58-0x00000000000A0000-0x00000000000BA000-memory.dmp

Filesize
104KB

Download
memory/1376-62-0x0000000000220000-0x0000000000234000-memory.dmp

Filesize
80KB

Download
memory/1376-64-0x00000000000A0000-0x00000000000BA000-memory.dmp

Filesize
104KB

Download
memory/1376-63-0x00000000000A0000-0x00000000000BA000-memory.dmp

Filesize
104KB

Download