63ea21a36fc87d840c094581cc4b0a4a974c2c0910d9425f4f8eb696ae52e099

Analysis

max time kernel
55s
max time network
142s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 23:19

Target

63ea21a36fc87d840c094581cc4b0a4a974c2c0910d9425f4f8eb696ae52e099.dll
Size

412KB
MD5

48de75d8b4a464998121682b80475e5f
SHA1

2afb747092ba69f49c738197434e0cd2ad81ee2e
SHA256

63ea21a36fc87d840c094581cc4b0a4a974c2c0910d9425f4f8eb696ae52e099
SHA512

7ab4ad9bc457bc8b15e48970e75b9e4aa0dd20f051edd8078076957b7079b38676a8f281f9617847a2952d1d3e719b62f5ef62dae20c2d8b90ca31c9856b691a
SSDEEP

6144:yYPss2uQdVth7ae1GNbYwJYPd8Rr+Q2p73I+E7viF1T6412juFBHq+t+NB:yYF2n3th+e1GxXJ4GRq774zK2tieXL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1476	1864	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 516 wrote to memory of 1864	516	rundll32.exe	28
PID 516 wrote to memory of 1864	516	rundll32.exe	28
PID 516 wrote to memory of 1864	516	rundll32.exe	28
PID 516 wrote to memory of 1864	516	rundll32.exe	28
PID 516 wrote to memory of 1864	516	rundll32.exe	28
PID 516 wrote to memory of 1864	516	rundll32.exe	28
PID 516 wrote to memory of 1864	516	rundll32.exe	28
PID 1864 wrote to memory of 1476	1864	rundll32.exe	29
PID 1864 wrote to memory of 1476	1864	rundll32.exe	29
PID 1864 wrote to memory of 1476	1864	rundll32.exe	29
PID 1864 wrote to memory of 1476	1864	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\63ea21a36fc87d840c094581cc4b0a4a974c2c0910d9425f4f8eb696ae52e099.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\63ea21a36fc87d840c094581cc4b0a4a974c2c0910d9425f4f8eb696ae52e099.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 264
    3⤵
    - Program crash
    PID:1476

memory/1864-55-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/1864-56-0x0000000000250000-0x00000000002AC000-memory.dmp

Filesize
368KB

Download
memory/1864-57-0x00000000003E0000-0x0000000000449000-memory.dmp

Filesize
420KB

Download
memory/1864-61-0x00000000003E0000-0x0000000000449000-memory.dmp

Filesize
420KB

Download
memory/1864-62-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1864-64-0x0000000000250000-0x00000000002AC000-memory.dmp

Filesize
368KB

Download