a4651c030d20f97245d32fd83fd4d2ef4e95f6ab673a15703fef3044efdd6c9d

Analysis

max time kernel
57s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 20:11

Target

a4651c030d20f97245d32fd83fd4d2ef4e95f6ab673a15703fef3044efdd6c9d.dll
Size

457KB
MD5

097e1442f119616946293167acf54e82
SHA1

f83571ca91f7d79a4bc691ddb1a68d5ee144760e
SHA256

a4651c030d20f97245d32fd83fd4d2ef4e95f6ab673a15703fef3044efdd6c9d
SHA512

11052d51833fe799a8068a33ea2fb86ecc1237961bcf2d77dea74333f8e5f5073f4bb20937a54c2d7b8e7f5cc1f1a12337d1cba83b763bc1fbca5d3b940006b9
SSDEEP

12288:Klj1429y58dYq0/pS0NWbD2vGiETNjSxV:Y142daq0hSVDuaN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1240	288	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 288	1056	rundll32.exe	28
PID 1056 wrote to memory of 288	1056	rundll32.exe	28
PID 1056 wrote to memory of 288	1056	rundll32.exe	28
PID 1056 wrote to memory of 288	1056	rundll32.exe	28
PID 1056 wrote to memory of 288	1056	rundll32.exe	28
PID 1056 wrote to memory of 288	1056	rundll32.exe	28
PID 1056 wrote to memory of 288	1056	rundll32.exe	28
PID 288 wrote to memory of 1240	288	rundll32.exe	29
PID 288 wrote to memory of 1240	288	rundll32.exe	29
PID 288 wrote to memory of 1240	288	rundll32.exe	29
PID 288 wrote to memory of 1240	288	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4651c030d20f97245d32fd83fd4d2ef4e95f6ab673a15703fef3044efdd6c9d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4651c030d20f97245d32fd83fd4d2ef4e95f6ab673a15703fef3044efdd6c9d.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:288
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 288 -s 256
    3⤵
    - Program crash
    PID:1240

memory/288-54-0x0000000000000000-mapping.dmp

Download
memory/288-55-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/288-56-0x00000000003C0000-0x0000000000435000-memory.dmp

Filesize
468KB

Download
memory/288-61-0x0000000000170000-0x00000000001D5000-memory.dmp

Filesize
404KB

Download
memory/1240-60-0x0000000000000000-mapping.dmp

Download