95b815a149191020a5a97d149144d6acf441ac1d23a8d9efa60e8d1742b34352

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 21:39

Target

95b815a149191020a5a97d149144d6acf441ac1d23a8d9efa60e8d1742b34352.dll
Size

144KB
MD5

285a93d9e01bfbae678799f0f1167cbd
SHA1

4508349998697bba4876c3b1669673c741f5efa1
SHA256

95b815a149191020a5a97d149144d6acf441ac1d23a8d9efa60e8d1742b34352
SHA512

47e3268323e3c05b52314fe5bbdd57721f482bed8f0035f160266375122a8ccf83f801cac542bbfd24ace25ed8bed73c5f76294df3973b0f6cc4b28378d25562
SSDEEP

3072:nTa79msLLh6kz0kYwYuubVk7qVzXhp/rCoh:Ta7sYLokNYwXuk7qfp/rlh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1680	1628	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 1628	1568	rundll32.exe	28
PID 1568 wrote to memory of 1628	1568	rundll32.exe	28
PID 1568 wrote to memory of 1628	1568	rundll32.exe	28
PID 1568 wrote to memory of 1628	1568	rundll32.exe	28
PID 1568 wrote to memory of 1628	1568	rundll32.exe	28
PID 1568 wrote to memory of 1628	1568	rundll32.exe	28
PID 1568 wrote to memory of 1628	1568	rundll32.exe	28
PID 1628 wrote to memory of 1680	1628	rundll32.exe	29
PID 1628 wrote to memory of 1680	1628	rundll32.exe	29
PID 1628 wrote to memory of 1680	1628	rundll32.exe	29
PID 1628 wrote to memory of 1680	1628	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\95b815a149191020a5a97d149144d6acf441ac1d23a8d9efa60e8d1742b34352.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\95b815a149191020a5a97d149144d6acf441ac1d23a8d9efa60e8d1742b34352.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 288
    3⤵
    - Program crash
    PID:1680

memory/1628-55-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download
memory/1628-56-0x0000000000161000-0x000000000017B000-memory.dmp

Filesize
104KB

Download
memory/1628-59-0x0000000000150000-0x000000000017A000-memory.dmp

Filesize
168KB

Download
memory/1628-60-0x0000000000160000-0x000000000018A000-memory.dmp

Filesize
168KB

Download
memory/1628-58-0x0000000000150000-0x000000000017A000-memory.dmp

Filesize
168KB

Download
memory/1628-61-0x0000000000150000-0x000000000017A000-memory.dmp

Filesize
168KB

Download