24699167047a3de6cfc2a1870844322ad0e2296781da3247586b7bf9d1142b44

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 14:35

Target

24699167047a3de6cfc2a1870844322ad0e2296781da3247586b7bf9d1142b44.dll
Size

410KB
MD5

9c22c3b085835f66eaf76c73fb2f82b1
SHA1

67a45aff2e8e6d4d12a521ed0e1e6a8b92049c53
SHA256

24699167047a3de6cfc2a1870844322ad0e2296781da3247586b7bf9d1142b44
SHA512

33ff3ac4ce1dcde4d94c664de9696793766c7df9386bbbd813aa5c50bc8d1ef8e551aacfd72996e4551bd81da1de5a61a187cc29ea25fd85d364d16fee8e2322
SSDEEP

1536:9kbN9YMfWngGotv6K3ToeR0oTZUrMTYTcBZDQe3m+Wbfscgg+:9+NKMeHY0bgOczD9Rfcgg+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
620	1480	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 1480	1448	rundll32.exe	27
PID 1448 wrote to memory of 1480	1448	rundll32.exe	27
PID 1448 wrote to memory of 1480	1448	rundll32.exe	27
PID 1448 wrote to memory of 1480	1448	rundll32.exe	27
PID 1448 wrote to memory of 1480	1448	rundll32.exe	27
PID 1448 wrote to memory of 1480	1448	rundll32.exe	27
PID 1448 wrote to memory of 1480	1448	rundll32.exe	27
PID 1480 wrote to memory of 620	1480	rundll32.exe	28
PID 1480 wrote to memory of 620	1480	rundll32.exe	28
PID 1480 wrote to memory of 620	1480	rundll32.exe	28
PID 1480 wrote to memory of 620	1480	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24699167047a3de6cfc2a1870844322ad0e2296781da3247586b7bf9d1142b44.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\24699167047a3de6cfc2a1870844322ad0e2296781da3247586b7bf9d1142b44.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 224
    3⤵
    - Program crash
    PID:620

memory/1480-55-0x00000000758B1000-0x00000000758B3000-memory.dmp

Filesize
8KB

Download
memory/1480-57-0x000000001FCB0000-0x000000001FD1C000-memory.dmp

Filesize
432KB

Download