5fc45785cf895f05d6378525ce437f041adf0dd02b578facd523d378b8947ccf

Analysis

max time kernel
35s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 16:42

Target

5fc45785cf895f05d6378525ce437f041adf0dd02b578facd523d378b8947ccf.dll
Size

159KB
MD5

64634729de3da71d755617ac83934919
SHA1

8a3838592848b004503bcf3a2d6a654b328b55cd
SHA256

5fc45785cf895f05d6378525ce437f041adf0dd02b578facd523d378b8947ccf
SHA512

acd96cee27cc33a681760355342a5c51f6277a5d6759ee82818ee27d25aa5b4b4a955758c452a9846aab699a23de9a89d20a1e52987c7682ed6a14b4f4456cac
SSDEEP

3072:ngikbXp3BvScvqzzxVvAAWJ6AzuHTBfZSLO/yarov:YTdRXvqXxh1WJJzuHTBRSa/z

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1480 1248 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1248 rundll32.exe

pid	pid_target	process	target process
1480	1248	WerFault.exe	rundll32.exe

pid	process
1248	rundll32.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1356 wrote to memory of 1248	1356	rundll32.exe	rundll32.exe
PID 1356 wrote to memory of 1248	1356	rundll32.exe	rundll32.exe
PID 1356 wrote to memory of 1248	1356	rundll32.exe	rundll32.exe
PID 1356 wrote to memory of 1248	1356	rundll32.exe	rundll32.exe
PID 1356 wrote to memory of 1248	1356	rundll32.exe	rundll32.exe
PID 1356 wrote to memory of 1248	1356	rundll32.exe	rundll32.exe
PID 1356 wrote to memory of 1248	1356	rundll32.exe	rundll32.exe
PID 1248 wrote to memory of 1096	1248	rundll32.exe	wermgr.exe
PID 1248 wrote to memory of 1096	1248	rundll32.exe	wermgr.exe
PID 1248 wrote to memory of 1096	1248	rundll32.exe	wermgr.exe
PID 1248 wrote to memory of 1096	1248	rundll32.exe	wermgr.exe
PID 1248 wrote to memory of 1480	1248	rundll32.exe	WerFault.exe
PID 1248 wrote to memory of 1480	1248	rundll32.exe	WerFault.exe
PID 1248 wrote to memory of 1480	1248	rundll32.exe	WerFault.exe
PID 1248 wrote to memory of 1480	1248	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5fc45785cf895f05d6378525ce437f041adf0dd02b578facd523d378b8947ccf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 360
3⤵
- Program crash
PID:1480

memory/1248-54-0x0000000000000000-mapping.dmp

Download
memory/1248-55-0x00000000760A1000-0x00000000760A3000-memory.dmp

Filesize
8KB

Download
memory/1480-56-0x0000000000000000-mapping.dmp

Download