cf383460f43a4ba93d9c2f7692a166bfea95246f40e4e36e7fa20f3f6a8f5b08

Analysis

max time kernel
15s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 17:21

Target

cf383460f43a4ba93d9c2f7692a166bfea95246f40e4e36e7fa20f3f6a8f5b08.dll
Size

439KB
MD5

1c462d47ef2101bfb406ed68ec8418e7
SHA1

cb7635799e681ed79a42a8d6d8f5ff260bc238b2
SHA256

cf383460f43a4ba93d9c2f7692a166bfea95246f40e4e36e7fa20f3f6a8f5b08
SHA512

8f53c131e83fdac6eddfaf011510b2225e7f4e4eed0a461824f11cfede9dbf445bca47b3cb12bbcf763b58e30cc3b62f1205914f1a46c4a6de37247b690a2b8c
SSDEEP

6144:WqYX9KGCc5x1gsS9dO3Ou47yAXd1g/iEyi9Jn3MQz8fWARUV3TV5:u9T9xYju4/y/1d9JnVPOw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
764	944	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 944	1368	rundll32.exe	28
PID 1368 wrote to memory of 944	1368	rundll32.exe	28
PID 1368 wrote to memory of 944	1368	rundll32.exe	28
PID 1368 wrote to memory of 944	1368	rundll32.exe	28
PID 1368 wrote to memory of 944	1368	rundll32.exe	28
PID 1368 wrote to memory of 944	1368	rundll32.exe	28
PID 1368 wrote to memory of 944	1368	rundll32.exe	28
PID 944 wrote to memory of 764	944	rundll32.exe	29
PID 944 wrote to memory of 764	944	rundll32.exe	29
PID 944 wrote to memory of 764	944	rundll32.exe	29
PID 944 wrote to memory of 764	944	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf383460f43a4ba93d9c2f7692a166bfea95246f40e4e36e7fa20f3f6a8f5b08.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf383460f43a4ba93d9c2f7692a166bfea95246f40e4e36e7fa20f3f6a8f5b08.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 944 -s 256
    3⤵
    - Program crash
    PID:764

memory/944-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/944-56-0x0000000000460000-0x00000000004D0000-memory.dmp

Filesize
448KB

Download
memory/944-60-0x00000000001C0000-0x000000000021F000-memory.dmp

Filesize
380KB

Download