8b75b8cd12175efc656a973ca07446ee92e29e08454e7147933297831f28685e

Analysis

max time kernel
3s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 10:22

Target

8b75b8cd12175efc656a973ca07446ee92e29e08454e7147933297831f28685e.dll
Size

1.0MB
MD5

3852d0e97433ed4e9eb8360b20702d4c
SHA1

f433a951cec61a88b8fa9ba25b7cd85d533adf3e
SHA256

8b75b8cd12175efc656a973ca07446ee92e29e08454e7147933297831f28685e
SHA512

5f4409e4cbf2d41c431c60a23e568a7c2f5b0dba0cb405dd39721dcd40465ce538319a7d79a5b9b2d61b090bfac69236f42f0084ff885ab4c0f92ab12dfff210
SSDEEP

24576:uPQOOLIW5h/g4AFwYmKq9Er4q9W1f7XFpfUYeXzwhHNx:uIOOL/h/WmOrDW1DXFZnec9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1108	1348	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1348	1640	rundll32.exe	27
PID 1640 wrote to memory of 1348	1640	rundll32.exe	27
PID 1640 wrote to memory of 1348	1640	rundll32.exe	27
PID 1640 wrote to memory of 1348	1640	rundll32.exe	27
PID 1640 wrote to memory of 1348	1640	rundll32.exe	27
PID 1640 wrote to memory of 1348	1640	rundll32.exe	27
PID 1640 wrote to memory of 1348	1640	rundll32.exe	27
PID 1348 wrote to memory of 1108	1348	rundll32.exe	28
PID 1348 wrote to memory of 1108	1348	rundll32.exe	28
PID 1348 wrote to memory of 1108	1348	rundll32.exe	28
PID 1348 wrote to memory of 1108	1348	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8b75b8cd12175efc656a973ca07446ee92e29e08454e7147933297831f28685e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8b75b8cd12175efc656a973ca07446ee92e29e08454e7147933297831f28685e.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 236
    3⤵
    - Program crash
    PID:1108

memory/1348-55-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/1348-56-0x0000000001EE0000-0x0000000002134000-memory.dmp

Filesize
2.3MB

Download
memory/1348-60-0x0000000001EE0000-0x0000000002134000-memory.dmp

Filesize
2.3MB

Download