9f9df1f5db18cf55d6e37602ed344f288f5634e112030c64f92e99de2fcac423

Analysis

max time kernel
33s
max time network
58s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 16:50

Target

9f9df1f5db18cf55d6e37602ed344f288f5634e112030c64f92e99de2fcac423.dll
Size

264KB
MD5

c95cae800affa444ef8903281b1505b0
SHA1

02be31636a0b9cfbf7f96dcc515ac8e247bd3386
SHA256

9f9df1f5db18cf55d6e37602ed344f288f5634e112030c64f92e99de2fcac423
SHA512

42167b5a6bf4db41926f6b2d3cfbf4f3cc7dae963173c51b57decc9aeb4fbc04e6692023658da7c622612842bc2d3edcf106d981c0c7bf2789dc0b4af69e8c06
SSDEEP

3072:k1wPuBQf8aow8Z4LrmM0M5qz0CKFLwTYIttW6YFLwTYIttW6YFLwTYIttW6auf:kOP9odGm5qqz0CKZwC6YZwC6YZwC6h

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	1468	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
652	1468	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 1468	1552	rundll32.exe	28
PID 1552 wrote to memory of 1468	1552	rundll32.exe	28
PID 1552 wrote to memory of 1468	1552	rundll32.exe	28
PID 1552 wrote to memory of 1468	1552	rundll32.exe	28
PID 1552 wrote to memory of 1468	1552	rundll32.exe	28
PID 1552 wrote to memory of 1468	1552	rundll32.exe	28
PID 1552 wrote to memory of 1468	1552	rundll32.exe	28
PID 1468 wrote to memory of 652	1468	rundll32.exe	29
PID 1468 wrote to memory of 652	1468	rundll32.exe	29
PID 1468 wrote to memory of 652	1468	rundll32.exe	29
PID 1468 wrote to memory of 652	1468	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f9df1f5db18cf55d6e37602ed344f288f5634e112030c64f92e99de2fcac423.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f9df1f5db18cf55d6e37602ed344f288f5634e112030c64f92e99de2fcac423.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 224
    3⤵
    - Program crash
    PID:652

memory/1468-55-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download