19f1709b37eabe75b2f5e1e73f25f04d22e2875cf51475cef9d4d73742493179

Analysis

max time kernel
56s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 11:26

Target

19f1709b37eabe75b2f5e1e73f25f04d22e2875cf51475cef9d4d73742493179.dll
Size

128KB
MD5

336ada3a8078617a0359b7756eae0aa3
SHA1

7e6870a527ffb5235ee2b4235cd8e74eb0f69d0e
SHA256

19f1709b37eabe75b2f5e1e73f25f04d22e2875cf51475cef9d4d73742493179
SHA512

b8a9928048308c95d0aa77ae4db077657a4e2913143c7b8344d12de9e895f8ca8a70625379383e185fd9ff86c289736dabef98969adf49655a774e1fc6704e34
SSDEEP

1536:XXZpU6sVos/XCQ+mV54PhISBTBKu7cyThlC7/W8GQlZb/p1IFAxibVh:BsVogSHmX+bjoZGQlZbsSGh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1576	936	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 936	1792	rundll32.exe	28
PID 1792 wrote to memory of 936	1792	rundll32.exe	28
PID 1792 wrote to memory of 936	1792	rundll32.exe	28
PID 1792 wrote to memory of 936	1792	rundll32.exe	28
PID 1792 wrote to memory of 936	1792	rundll32.exe	28
PID 1792 wrote to memory of 936	1792	rundll32.exe	28
PID 1792 wrote to memory of 936	1792	rundll32.exe	28
PID 936 wrote to memory of 1576	936	rundll32.exe	29
PID 936 wrote to memory of 1576	936	rundll32.exe	29
PID 936 wrote to memory of 1576	936	rundll32.exe	29
PID 936 wrote to memory of 1576	936	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\19f1709b37eabe75b2f5e1e73f25f04d22e2875cf51475cef9d4d73742493179.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\19f1709b37eabe75b2f5e1e73f25f04d22e2875cf51475cef9d4d73742493179.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 228
    3⤵
    - Program crash
    PID:1576

memory/936-55-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download