8055ce5a4cc35e1d9a9cd4700626231067a2c03f4475e5e03305ff5c0161d6b8

Analysis

max time kernel
31s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 22:23

Target

8055ce5a4cc35e1d9a9cd4700626231067a2c03f4475e5e03305ff5c0161d6b8.dll
Size

149KB
MD5

4f2279ae05d36e31ff31476600bcbca8
SHA1

c4641ef21d9a9fd8cc236a920465ea0ad68a7e03
SHA256

8055ce5a4cc35e1d9a9cd4700626231067a2c03f4475e5e03305ff5c0161d6b8
SHA512

27d568334b568b4e563f2c3be685df901f1eaa011c567f787538e7675ecfbed5ae5cda1bb41a57d3f409808406246ec091d5536becf2aa5d5bf269615719e1cd
SSDEEP

3072:aqW8h34ZG8tpm8oydrj2lRUW0/graVWj7Qu258vD9+dKrIBs:tW8hEegZ7IWVU25W9+dW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
472	1120	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 1120	1888	rundll32.exe	28
PID 1888 wrote to memory of 1120	1888	rundll32.exe	28
PID 1888 wrote to memory of 1120	1888	rundll32.exe	28
PID 1888 wrote to memory of 1120	1888	rundll32.exe	28
PID 1888 wrote to memory of 1120	1888	rundll32.exe	28
PID 1888 wrote to memory of 1120	1888	rundll32.exe	28
PID 1888 wrote to memory of 1120	1888	rundll32.exe	28
PID 1120 wrote to memory of 472	1120	rundll32.exe	29
PID 1120 wrote to memory of 472	1120	rundll32.exe	29
PID 1120 wrote to memory of 472	1120	rundll32.exe	29
PID 1120 wrote to memory of 472	1120	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8055ce5a4cc35e1d9a9cd4700626231067a2c03f4475e5e03305ff5c0161d6b8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8055ce5a4cc35e1d9a9cd4700626231067a2c03f4475e5e03305ff5c0161d6b8.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 256
    3⤵
    - Program crash
    PID:472

memory/1120-55-0x0000000075891000-0x0000000075893000-memory.dmp

Filesize
8KB

Download
memory/1120-56-0x0000000000190000-0x00000000001A2000-memory.dmp

Filesize
72KB

Download
memory/1120-57-0x00000000001D0000-0x00000000001F8000-memory.dmp

Filesize
160KB

Download
memory/1120-61-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/1120-62-0x0000000000190000-0x00000000001A2000-memory.dmp

Filesize
72KB

Download