12ee86645798c450bffbaaf4f07c4a1fef1e5997c90b19ac324cd877714eb2a8

Analysis

max time kernel
32s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 19:01

Target

12ee86645798c450bffbaaf4f07c4a1fef1e5997c90b19ac324cd877714eb2a8.dll
Size

120KB
MD5

9fcc1b73813358d8f62d4b895fd6aaa0
SHA1

a425cebd0ee9836b02fbf99e4a96626281e00203
SHA256

12ee86645798c450bffbaaf4f07c4a1fef1e5997c90b19ac324cd877714eb2a8
SHA512

bc768f6aa61072046ddb48a7a3948ae3b8ae187477a6a3e013f96151e0a7402ca4e82bed3a2531f69d0edc0eaa0539bc4a81a695483cdf7a929eea6bc3efcd18
SSDEEP

1536:5GQwW3L2qhnER13r9bIKrTulhRzIwsbvNTfEp6tQEKNPHJazlw/TJXj0xcIwCLtj:5GQfER13JblrohRaWQwHAw/tj0KCpiU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2036	1536	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 1536	908	rundll32.exe	27
PID 908 wrote to memory of 1536	908	rundll32.exe	27
PID 908 wrote to memory of 1536	908	rundll32.exe	27
PID 908 wrote to memory of 1536	908	rundll32.exe	27
PID 908 wrote to memory of 1536	908	rundll32.exe	27
PID 908 wrote to memory of 1536	908	rundll32.exe	27
PID 908 wrote to memory of 1536	908	rundll32.exe	27
PID 1536 wrote to memory of 2036	1536	rundll32.exe	28
PID 1536 wrote to memory of 2036	1536	rundll32.exe	28
PID 1536 wrote to memory of 2036	1536	rundll32.exe	28
PID 1536 wrote to memory of 2036	1536	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12ee86645798c450bffbaaf4f07c4a1fef1e5997c90b19ac324cd877714eb2a8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\12ee86645798c450bffbaaf4f07c4a1fef1e5997c90b19ac324cd877714eb2a8.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 196
    3⤵
    - Program crash
    PID:2036

memory/1536-55-0x0000000075131000-0x0000000075133000-memory.dmp

Filesize
8KB

Download
memory/1536-57-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download