c370fb001f2e6ef146c3092596a47642e51e957e41b4a730f938f2465d97b400

Analysis

max time kernel
36s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 08:36

Target

c370fb001f2e6ef146c3092596a47642e51e957e41b4a730f938f2465d97b400.dll
Size

428KB
MD5

0db1447fb43f1ebb4c290cdd2c05674b
SHA1

8bb0482cbfd999af3c10f78ef9ddea2ea2b22984
SHA256

c370fb001f2e6ef146c3092596a47642e51e957e41b4a730f938f2465d97b400
SHA512

22901f8d92b92c38b6caec9cb12e93c1259cb783705cef9869c36f106766edde00f1d0a67ec54bd6dd94e0fa7e2c8eb4bea3ad2fc4faa58a5a24f9e7605200e5
SSDEEP

12288:aJfGFZJ4C0gqpv231OC1dTdxGmnOzw/n+:Rxz0ggUdTH7hn+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1740	2040	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 2040	1416	rundll32.exe	27
PID 1416 wrote to memory of 2040	1416	rundll32.exe	27
PID 1416 wrote to memory of 2040	1416	rundll32.exe	27
PID 1416 wrote to memory of 2040	1416	rundll32.exe	27
PID 1416 wrote to memory of 2040	1416	rundll32.exe	27
PID 1416 wrote to memory of 2040	1416	rundll32.exe	27
PID 1416 wrote to memory of 2040	1416	rundll32.exe	27
PID 2040 wrote to memory of 1740	2040	rundll32.exe	28
PID 2040 wrote to memory of 1740	2040	rundll32.exe	28
PID 2040 wrote to memory of 1740	2040	rundll32.exe	28
PID 2040 wrote to memory of 1740	2040	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c370fb001f2e6ef146c3092596a47642e51e957e41b4a730f938f2465d97b400.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c370fb001f2e6ef146c3092596a47642e51e957e41b4a730f938f2465d97b400.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 296
    3⤵
    - Program crash
    PID:1740

memory/2040-55-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/2040-57-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2040-58-0x0000000000490000-0x00000000004DB000-memory.dmp

Filesize
300KB

Download
memory/2040-59-0x0000000002710000-0x0000000002713000-memory.dmp

Filesize
12KB

Download