28d6ca38d2775d0e3c54b0327ca9100a7a56e8ebbc5b5ec61249921af0cc6f35

Analysis

max time kernel
35s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 06:06

Target

28d6ca38d2775d0e3c54b0327ca9100a7a56e8ebbc5b5ec61249921af0cc6f35.dll
Size

376KB
MD5

fd08f0b2666336ba5c45d145ce2ec2f0
SHA1

ca979f503b452aa99e09cf4bdd0a036676a77ce3
SHA256

28d6ca38d2775d0e3c54b0327ca9100a7a56e8ebbc5b5ec61249921af0cc6f35
SHA512

bff1151d46fe34616f90a1e91570c673a079416c4b79c6452e536e7e30bc18438180f81b0f6bba2c8d8e686a26e2f512ac428ec9cdc696789c781e7c809f5325
SSDEEP

6144:3X96Jq6BMwYrKsQ5dm1LCCaeHGY0mOcWKyKYVSm6gctj060cQGIb79OHPRSVZsSC:3X6RrWlPakOuyK06bxsDHb7vVZs4mRWm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1984	1980	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26
PID 1992 wrote to memory of 1980	1992	rundll32.exe	26
PID 1980 wrote to memory of 1984	1980	rundll32.exe	27
PID 1980 wrote to memory of 1984	1980	rundll32.exe	27
PID 1980 wrote to memory of 1984	1980	rundll32.exe	27
PID 1980 wrote to memory of 1984	1980	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\28d6ca38d2775d0e3c54b0327ca9100a7a56e8ebbc5b5ec61249921af0cc6f35.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\28d6ca38d2775d0e3c54b0327ca9100a7a56e8ebbc5b5ec61249921af0cc6f35.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 240
    3⤵
    - Program crash
    PID:1984

memory/1980-55-0x0000000076141000-0x0000000076143000-memory.dmp

Filesize
8KB

Download
memory/1980-56-0x0000000000490000-0x00000000004EE000-memory.dmp

Filesize
376KB

Download
memory/1980-60-0x0000000000120000-0x0000000000157000-memory.dmp

Filesize
220KB

Download