1430e5e94489cc34317b16bda414ad5bcf1d7feb469fc4613f2ea78c32d3b4b1

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 06:33

Target

1430e5e94489cc34317b16bda414ad5bcf1d7feb469fc4613f2ea78c32d3b4b1.dll
Size

204KB
MD5

d2e7f76fb22814ce0ac46f30c60044b0
SHA1

ef20f2f8fed1ce2bc842dff0a9f67230fc9d47ec
SHA256

1430e5e94489cc34317b16bda414ad5bcf1d7feb469fc4613f2ea78c32d3b4b1
SHA512

dc3e2df9b2dd29401cd69ffa1aa577d8f9e4a464b5fef4f6d04a948dc7b5cb26db2a8c2f20e75344eff1778cefe633f8ccc94a717b4b723d601d1b8cb6642e26
SSDEEP

3072:9Ed8TBk7iWpIxdyDI23HdfSkJuYb5+AnPyVL3XHSscxRYjmH0qHpcO5VSneoEt5f:k26JS2py2toEtOE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
884	1852	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1852	2036	rundll32.exe	28
PID 2036 wrote to memory of 1852	2036	rundll32.exe	28
PID 2036 wrote to memory of 1852	2036	rundll32.exe	28
PID 2036 wrote to memory of 1852	2036	rundll32.exe	28
PID 2036 wrote to memory of 1852	2036	rundll32.exe	28
PID 2036 wrote to memory of 1852	2036	rundll32.exe	28
PID 2036 wrote to memory of 1852	2036	rundll32.exe	28
PID 1852 wrote to memory of 884	1852	rundll32.exe	29
PID 1852 wrote to memory of 884	1852	rundll32.exe	29
PID 1852 wrote to memory of 884	1852	rundll32.exe	29
PID 1852 wrote to memory of 884	1852	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1430e5e94489cc34317b16bda414ad5bcf1d7feb469fc4613f2ea78c32d3b4b1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1430e5e94489cc34317b16bda414ad5bcf1d7feb469fc4613f2ea78c32d3b4b1.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 268
    3⤵
    - Program crash
    PID:884

memory/1852-55-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download