af4925c45b5cc21dda12d9cd9cd85b881c0116746c3fcf861be6280671234bce

Analysis

max time kernel
39s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 19:28

Target

af4925c45b5cc21dda12d9cd9cd85b881c0116746c3fcf861be6280671234bce.dll
Size

446KB
MD5

962ce603f6c77f6b4be0533287ec8717
SHA1

ccd20a72288ade8a5c91cd94aafb46b52275a0a4
SHA256

af4925c45b5cc21dda12d9cd9cd85b881c0116746c3fcf861be6280671234bce
SHA512

603267f596e95a328cac749ae31d64e0ea747bd0f314ac50fee15db01d9867aafe35f2a1e600028609b405ebd99bbb2a7e52a16059ed74832d9e69e4d62aad46
SSDEEP

12288:w4BcGx6/txvFary/kLuJJzOVjB4ANDD+J7b:nHetxvFahLuPOFXliJ7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1128	1772	WerFault.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1772	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 1772	1456	rundll32.exe	28
PID 1456 wrote to memory of 1772	1456	rundll32.exe	28
PID 1456 wrote to memory of 1772	1456	rundll32.exe	28
PID 1456 wrote to memory of 1772	1456	rundll32.exe	28
PID 1456 wrote to memory of 1772	1456	rundll32.exe	28
PID 1456 wrote to memory of 1772	1456	rundll32.exe	28
PID 1456 wrote to memory of 1772	1456	rundll32.exe	28
PID 1772 wrote to memory of 1128	1772	rundll32.exe	29
PID 1772 wrote to memory of 1128	1772	rundll32.exe	29
PID 1772 wrote to memory of 1128	1772	rundll32.exe	29
PID 1772 wrote to memory of 1128	1772	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af4925c45b5cc21dda12d9cd9cd85b881c0116746c3fcf861be6280671234bce.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\af4925c45b5cc21dda12d9cd9cd85b881c0116746c3fcf861be6280671234bce.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 240
    3⤵
    - Program crash
    PID:1128

memory/1772-55-0x00000000766F1000-0x00000000766F3000-memory.dmp

Filesize
8KB

Download
memory/1772-56-0x0000000000240000-0x00000000002B3000-memory.dmp

Filesize
460KB

Download
memory/1772-60-0x00000000001E0000-0x0000000000240000-memory.dmp

Filesize
384KB

Download