85a853ae5277b3df847f770f2ebec4e56539fa5f44bbfd7e335c0ba125131d6d

Analysis

max time kernel
164s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 20:59

Target

85a853ae5277b3df847f770f2ebec4e56539fa5f44bbfd7e335c0ba125131d6d.dll
Size

73KB
MD5

ddfa56ab2189a08cf4be7ceb60c00ae5
SHA1

5f9b5135f8141757eb7f5e79c339c9c9e021904d
SHA256

85a853ae5277b3df847f770f2ebec4e56539fa5f44bbfd7e335c0ba125131d6d
SHA512

e588e76d4022e5cfa8a1005a5066fa93a1aee1742384d28874b31305a63f06e277959767f0fe0f66730fa0537e23089ff5063a515ad1b998fb5f1e64db1fd195
SSDEEP

1536:pZIZqCTsWlG080IjesJMVxKOdNA2HqsH+hayXXpNI:QnTNlG08JjPGVRHRHmayXXpNI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1716	1628	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 1628	844	rundll32.exe	28
PID 844 wrote to memory of 1628	844	rundll32.exe	28
PID 844 wrote to memory of 1628	844	rundll32.exe	28
PID 844 wrote to memory of 1628	844	rundll32.exe	28
PID 844 wrote to memory of 1628	844	rundll32.exe	28
PID 844 wrote to memory of 1628	844	rundll32.exe	28
PID 844 wrote to memory of 1628	844	rundll32.exe	28
PID 1628 wrote to memory of 1716	1628	rundll32.exe	29
PID 1628 wrote to memory of 1716	1628	rundll32.exe	29
PID 1628 wrote to memory of 1716	1628	rundll32.exe	29
PID 1628 wrote to memory of 1716	1628	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\85a853ae5277b3df847f770f2ebec4e56539fa5f44bbfd7e335c0ba125131d6d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\85a853ae5277b3df847f770f2ebec4e56539fa5f44bbfd7e335c0ba125131d6d.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 268
    3⤵
    - Program crash
    PID:1716

memory/1628-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1628-56-0x00000000000B1000-0x00000000000C0000-memory.dmp

Filesize
60KB

Download