d71fca4e45defab4f63516a1cac0d42ab73f988c3ad4a80509ca8d1372d39f0e

Analysis

max time kernel
39s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 04:01

Target

d71fca4e45defab4f63516a1cac0d42ab73f988c3ad4a80509ca8d1372d39f0e.dll
Size

368KB
MD5

09a825ffed35c210d17bb575deb965b0
SHA1

2ec5cc6cc0153ea45e474d20a1e7770cd25815c8
SHA256

d71fca4e45defab4f63516a1cac0d42ab73f988c3ad4a80509ca8d1372d39f0e
SHA512

5658e7caab070db9d1828b8cd2f402ffa4fd9365799b5779931d4d28e3a717f78cbd894492e41ecd5f3258077246d5af233775b3ddb0de57937ba839c0dae4a5
SSDEEP

6144:mt10NKnnSu/xs1822wSECNz/Ez2tQM/bWc1MfHdU6wQzWfu1pf3Q0BIJ0jm0pUI:mT0UV/n2/y/4wlbWcqfHdURAG+bZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
112	1536	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1388 wrote to memory of 1536	1388	rundll32.exe	26
PID 1536 wrote to memory of 112	1536	rundll32.exe	27
PID 1536 wrote to memory of 112	1536	rundll32.exe	27
PID 1536 wrote to memory of 112	1536	rundll32.exe	27
PID 1536 wrote to memory of 112	1536	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d71fca4e45defab4f63516a1cac0d42ab73f988c3ad4a80509ca8d1372d39f0e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d71fca4e45defab4f63516a1cac0d42ab73f988c3ad4a80509ca8d1372d39f0e.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 240
    3⤵
    - Program crash
    PID:112

memory/1536-55-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1536-56-0x0000000001D30000-0x0000000001D8C000-memory.dmp

Filesize
368KB

Download
memory/1536-61-0x0000000000190000-0x00000000001C3000-memory.dmp

Filesize
204KB

Download