bb224174d06d8596887495fd42fb7e396d40a170df580b6516bdc9ba2a982fe0

Analysis

max time kernel
33s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 18:42

Target

bb224174d06d8596887495fd42fb7e396d40a170df580b6516bdc9ba2a982fe0.dll
Size

364KB
MD5

7419d0869532bbb11a10b06c3a090d2c
SHA1

379651b3162307ef4700ba5834995e795fba3c21
SHA256

bb224174d06d8596887495fd42fb7e396d40a170df580b6516bdc9ba2a982fe0
SHA512

d61eb8769b255b15dd690e55663702879056128741e694176376eb20366939207c82484801958518df734bd8ff0ee44cb4202576200033e5413338125106f78e
SSDEEP

6144:Q6EA1vbIhGKJN415Tajqtp+VwynAtbalq8yxJsmKsC/HVPEboobtpdl63Xz/0OHT:NrKJNoJzFalq8yDsmKsC/Hq17dl6nz/P

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1156	1596	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1596	1656	rundll32.exe	28
PID 1656 wrote to memory of 1596	1656	rundll32.exe	28
PID 1656 wrote to memory of 1596	1656	rundll32.exe	28
PID 1656 wrote to memory of 1596	1656	rundll32.exe	28
PID 1656 wrote to memory of 1596	1656	rundll32.exe	28
PID 1656 wrote to memory of 1596	1656	rundll32.exe	28
PID 1656 wrote to memory of 1596	1656	rundll32.exe	28
PID 1596 wrote to memory of 1156	1596	rundll32.exe	29
PID 1596 wrote to memory of 1156	1596	rundll32.exe	29
PID 1596 wrote to memory of 1156	1596	rundll32.exe	29
PID 1596 wrote to memory of 1156	1596	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb224174d06d8596887495fd42fb7e396d40a170df580b6516bdc9ba2a982fe0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb224174d06d8596887495fd42fb7e396d40a170df580b6516bdc9ba2a982fe0.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 236
    3⤵
    - Program crash
    PID:1156

memory/1596-55-0x00000000767D1000-0x00000000767D3000-memory.dmp

Filesize
8KB

Download
memory/1596-56-0x00000000002D0000-0x000000000032E000-memory.dmp

Filesize
376KB

Download
memory/1596-59-0x00000000001D0000-0x000000000022E000-memory.dmp

Filesize
376KB

Download
memory/1596-61-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download