df23b01773f363320ed1f21fed25e38f4b0a6c2a773661a74b3069e898ce8868

Analysis

max time kernel
163s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 00:47

Target

df23b01773f363320ed1f21fed25e38f4b0a6c2a773661a74b3069e898ce8868.dll
Size

547KB
MD5

a7df0a6127f772afe722b792a0fb1950
SHA1

bf19e47fa47b78cf79564dd21c28e837ce93c09b
SHA256

df23b01773f363320ed1f21fed25e38f4b0a6c2a773661a74b3069e898ce8868
SHA512

a552944b0457e4b41d3c1074d96ba479cd75eb7efcb7b6481bd982f9b8c5df7740b9acca50527069774586e5224947abf6438d6a1c9b902bbc0bfc2fa15f9a7a
SSDEEP

3072:7eY+W3sxUvkUYGvf7+0Dt0fCpEmoJnn5XL7W65/FtA8z5Z0:7kJOkuKm06tyn5X26rx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1264	2008	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2008	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 2008	1892	rundll32.exe	28
PID 1892 wrote to memory of 2008	1892	rundll32.exe	28
PID 1892 wrote to memory of 2008	1892	rundll32.exe	28
PID 1892 wrote to memory of 2008	1892	rundll32.exe	28
PID 1892 wrote to memory of 2008	1892	rundll32.exe	28
PID 1892 wrote to memory of 2008	1892	rundll32.exe	28
PID 1892 wrote to memory of 2008	1892	rundll32.exe	28
PID 2008 wrote to memory of 1264	2008	rundll32.exe	29
PID 2008 wrote to memory of 1264	2008	rundll32.exe	29
PID 2008 wrote to memory of 1264	2008	rundll32.exe	29
PID 2008 wrote to memory of 1264	2008	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\df23b01773f363320ed1f21fed25e38f4b0a6c2a773661a74b3069e898ce8868.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\df23b01773f363320ed1f21fed25e38f4b0a6c2a773661a74b3069e898ce8868.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 252
    3⤵
    - Program crash
    PID:1264

memory/2008-55-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download
memory/2008-57-0x00000000749A0000-0x0000000074A30000-memory.dmp

Filesize
576KB

Download
memory/2008-58-0x0000000074910000-0x00000000749A0000-memory.dmp

Filesize
576KB

Download
memory/2008-59-0x00000000749A0000-0x0000000074A30000-memory.dmp

Filesize
576KB

Download
memory/2008-60-0x00000000749A0000-0x0000000074A30000-memory.dmp

Filesize
576KB

Download