add286b1e3056151f501902e15cad15b7917ae43612ecf2eb7a2204c70fd1818

Analysis

max time kernel
1s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 17:11

Target

add286b1e3056151f501902e15cad15b7917ae43612ecf2eb7a2204c70fd1818.dll
Size

106KB
MD5

4d7cd5604e49f8a2d64462fe4b9a735a
SHA1

8b655d6e88df60f1620b056e7a14ebcddcf4d8c6
SHA256

add286b1e3056151f501902e15cad15b7917ae43612ecf2eb7a2204c70fd1818
SHA512

7c8dede428c81caa379435ab2d0b0d766c5f39945290bb0249416adbc74f755e8840db1dfc88b34bd6beaa3bed2708f1a83f373613509ed4952cea06136fff38
SSDEEP

3072:iQQ2I4tMGoaDlBZvVXJNJOWYRkpJhE6O9i:iQQ4tMGNlBfXJmQhR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1344	1380	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 1380	1180	rundll32.exe	28
PID 1180 wrote to memory of 1380	1180	rundll32.exe	28
PID 1180 wrote to memory of 1380	1180	rundll32.exe	28
PID 1180 wrote to memory of 1380	1180	rundll32.exe	28
PID 1180 wrote to memory of 1380	1180	rundll32.exe	28
PID 1180 wrote to memory of 1380	1180	rundll32.exe	28
PID 1180 wrote to memory of 1380	1180	rundll32.exe	28
PID 1380 wrote to memory of 1344	1380	rundll32.exe	29
PID 1380 wrote to memory of 1344	1380	rundll32.exe	29
PID 1380 wrote to memory of 1344	1380	rundll32.exe	29
PID 1380 wrote to memory of 1344	1380	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\add286b1e3056151f501902e15cad15b7917ae43612ecf2eb7a2204c70fd1818.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\add286b1e3056151f501902e15cad15b7917ae43612ecf2eb7a2204c70fd1818.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 248
    3⤵
    - Program crash
    PID:1344

memory/1344-57-0x0000000000000000-mapping.dmp

Download
memory/1380-54-0x0000000000000000-mapping.dmp

Download
memory/1380-55-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/1380-56-0x0000000000121000-0x0000000000136000-memory.dmp

Filesize
84KB

Download