6fb2fcce4b265d3d52a59096ac8e0ee638e4b2616e19f887bd66abf3edccb9d3

Analysis

max time kernel
176s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 10:22

Target

6fb2fcce4b265d3d52a59096ac8e0ee638e4b2616e19f887bd66abf3edccb9d3.dll
Size

43KB
MD5

3c6ea94cd0f25829c9d3ff84dee618a0
SHA1

a2f520e1a683eb29c8676492793b43ab7ed29ccb
SHA256

6fb2fcce4b265d3d52a59096ac8e0ee638e4b2616e19f887bd66abf3edccb9d3
SHA512

924b4ac8966cb984146623e5300ab35a50d2e70f4a2b1dd9dc400b28b3bd5ceacc8c1fea01c1625ba9e8a03596baf56d2a6cc28a90ee44bd18faedf965fdcda6
SSDEEP

768:n2GeiQ/jhqrTvfQK00f9F273BfuhWArf4YdIOtHuuoh11XOFUuSFUo:2GuVqAK00fMB4WAT5VuuO9K3+d

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
992	1124	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 1124	1168	rundll32.exe	27
PID 1168 wrote to memory of 1124	1168	rundll32.exe	27
PID 1168 wrote to memory of 1124	1168	rundll32.exe	27
PID 1168 wrote to memory of 1124	1168	rundll32.exe	27
PID 1168 wrote to memory of 1124	1168	rundll32.exe	27
PID 1168 wrote to memory of 1124	1168	rundll32.exe	27
PID 1168 wrote to memory of 1124	1168	rundll32.exe	27
PID 1124 wrote to memory of 992	1124	rundll32.exe	28
PID 1124 wrote to memory of 992	1124	rundll32.exe	28
PID 1124 wrote to memory of 992	1124	rundll32.exe	28
PID 1124 wrote to memory of 992	1124	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6fb2fcce4b265d3d52a59096ac8e0ee638e4b2616e19f887bd66abf3edccb9d3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6fb2fcce4b265d3d52a59096ac8e0ee638e4b2616e19f887bd66abf3edccb9d3.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 296
    3⤵
    - Program crash
    PID:992

memory/1124-55-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download
memory/1124-56-0x0000000000310000-0x00000000003BC000-memory.dmp

Filesize
688KB

Download
memory/1124-57-0x00000000007E0000-0x0000000000880000-memory.dmp

Filesize
640KB

Download
memory/1124-58-0x0000000000230000-0x0000000000287000-memory.dmp

Filesize
348KB

Download
memory/1124-60-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download