278556b63d9043f2d1a772dd03f87a437134cb98157ddd3285a298fbdf0eb055

Analysis

max time kernel
39s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 06:07

Target

278556b63d9043f2d1a772dd03f87a437134cb98157ddd3285a298fbdf0eb055.dll
Size

184KB
MD5

b10e60c16c12d85f87b063400279ce50
SHA1

e9c1f04e56ce1b38f97f1cfad86f98fba6caff44
SHA256

278556b63d9043f2d1a772dd03f87a437134cb98157ddd3285a298fbdf0eb055
SHA512

1b426bfa7cab5a99bc94d9fe115aa046ccabb7c5ac18bdd18e2cb66055c9c5e741ccfb14ba370a351e09dad47e115c426135c4edfc3206c5366c59f6f62f482a
SSDEEP

3072:BT3iCcUl+CqmmM2wFIKWOGUABEB51fnZTBftDnyknUD03LzOycHrRIoqhydy:BXcwxqTM2wF+Jl2BvZTBlDnyknUD+1uY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1348	544	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 544	2036	rundll32.exe	26
PID 2036 wrote to memory of 544	2036	rundll32.exe	26
PID 2036 wrote to memory of 544	2036	rundll32.exe	26
PID 2036 wrote to memory of 544	2036	rundll32.exe	26
PID 2036 wrote to memory of 544	2036	rundll32.exe	26
PID 2036 wrote to memory of 544	2036	rundll32.exe	26
PID 2036 wrote to memory of 544	2036	rundll32.exe	26
PID 544 wrote to memory of 1348	544	rundll32.exe	27
PID 544 wrote to memory of 1348	544	rundll32.exe	27
PID 544 wrote to memory of 1348	544	rundll32.exe	27
PID 544 wrote to memory of 1348	544	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\278556b63d9043f2d1a772dd03f87a437134cb98157ddd3285a298fbdf0eb055.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\278556b63d9043f2d1a772dd03f87a437134cb98157ddd3285a298fbdf0eb055.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:544
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 544 -s 236
    3⤵
    - Program crash
    PID:1348

memory/544-55-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download