23ae3b854112db0d0183d40884a30baf5a1345d3438d4feab7ff1b5bf0e92d0b

Analysis

max time kernel
56s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 06:13

Target

23ae3b854112db0d0183d40884a30baf5a1345d3438d4feab7ff1b5bf0e92d0b.dll
Size

428KB
MD5

45b9233205823455a18f473e32d7b230
SHA1

c1e8f25dcbf5132fba9a416d7454c2765974e336
SHA256

23ae3b854112db0d0183d40884a30baf5a1345d3438d4feab7ff1b5bf0e92d0b
SHA512

3a8077c323b1117c91da95b27579807061a8eff7a2e27795a05f4f16f9abfc2ebf598553814f423917bcc1d17b4f6edb77dd2c44209b9ff07e49554056c1fe83
SSDEEP

6144:enUp27pa4ziXwkmR/9R3hNij1wolAR8SATpKUEZk1P4ZeV8Ngpvt:enk27l33aqrAEUWkCZ682

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1036	2032	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2032	2020	rundll32.exe	28
PID 2020 wrote to memory of 2032	2020	rundll32.exe	28
PID 2020 wrote to memory of 2032	2020	rundll32.exe	28
PID 2020 wrote to memory of 2032	2020	rundll32.exe	28
PID 2020 wrote to memory of 2032	2020	rundll32.exe	28
PID 2020 wrote to memory of 2032	2020	rundll32.exe	28
PID 2020 wrote to memory of 2032	2020	rundll32.exe	28
PID 2032 wrote to memory of 1036	2032	rundll32.exe	29
PID 2032 wrote to memory of 1036	2032	rundll32.exe	29
PID 2032 wrote to memory of 1036	2032	rundll32.exe	29
PID 2032 wrote to memory of 1036	2032	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\23ae3b854112db0d0183d40884a30baf5a1345d3438d4feab7ff1b5bf0e92d0b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\23ae3b854112db0d0183d40884a30baf5a1345d3438d4feab7ff1b5bf0e92d0b.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 264
    3⤵
    - Program crash
    PID:1036

memory/2032-55-0x0000000076531000-0x0000000076533000-memory.dmp

Filesize
8KB

Download
memory/2032-56-0x00000000007F0000-0x000000000085D000-memory.dmp

Filesize
436KB

Download
memory/2032-60-0x0000000010000000-0x000000001006D000-memory.dmp

Filesize
436KB

Download
memory/2032-61-0x0000000000700000-0x000000000075E000-memory.dmp

Filesize
376KB

Download