848d522c619b0c73b20355275223fd72f515f3c6f5f76a06b8757dd4c2e062dd

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 20:38

Target

848d522c619b0c73b20355275223fd72f515f3c6f5f76a06b8757dd4c2e062dd.dll
Size

112KB
MD5

ab74a7e4f7065c581af54488bbfdfa38
SHA1

c8fdfa475f717a9413ebc518b128c91dfb1611ba
SHA256

848d522c619b0c73b20355275223fd72f515f3c6f5f76a06b8757dd4c2e062dd
SHA512

015ec1c583de9ce850c518bed7c70543d4014c48b73fe5cbca2424ef36fc6ddbf6caec2462014d0004a08187bb5d74c81cd43198d858d59e5653d327a7e62d0f
SSDEEP

3072:NfnU7Buu6poY4s3JebwVCEPCl4rGxckw:K7hs

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
936	1692	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 1692	1900	rundll32.exe	27
PID 1900 wrote to memory of 1692	1900	rundll32.exe	27
PID 1900 wrote to memory of 1692	1900	rundll32.exe	27
PID 1900 wrote to memory of 1692	1900	rundll32.exe	27
PID 1900 wrote to memory of 1692	1900	rundll32.exe	27
PID 1900 wrote to memory of 1692	1900	rundll32.exe	27
PID 1900 wrote to memory of 1692	1900	rundll32.exe	27
PID 1692 wrote to memory of 936	1692	rundll32.exe	28
PID 1692 wrote to memory of 936	1692	rundll32.exe	28
PID 1692 wrote to memory of 936	1692	rundll32.exe	28
PID 1692 wrote to memory of 936	1692	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\848d522c619b0c73b20355275223fd72f515f3c6f5f76a06b8757dd4c2e062dd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\848d522c619b0c73b20355275223fd72f515f3c6f5f76a06b8757dd4c2e062dd.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 228
    3⤵
    - Program crash
    PID:936

memory/1692-55-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download