93f87175db325269c91845de9dd4e5980ce8f7c03fa1e9c63a5fd974bc8755f8

Analysis

max time kernel
22s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 04:09

Target

93f87175db325269c91845de9dd4e5980ce8f7c03fa1e9c63a5fd974bc8755f8.dll
Size

152KB
MD5

8e5859e9b94b8df65b82447821fa3a0a
SHA1

27af16aed3ea748c9767785039581adf34c403ec
SHA256

93f87175db325269c91845de9dd4e5980ce8f7c03fa1e9c63a5fd974bc8755f8
SHA512

c9a333cab660c0cc4acb090993294700bf3f55bd305953e89c01104d7e6502aa46be6498b28c22f5636114b3fc0ff04bff474f4885a222987f78372800ef7c22
SSDEEP

3072:q7+5EpeJE1P6YTrbUXruOKDhGOTTTBftdqnu12:q7JNbbUXr+D7TTTBldqnu1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1420	1948	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 1948	1952	rundll32.exe	28
PID 1952 wrote to memory of 1948	1952	rundll32.exe	28
PID 1952 wrote to memory of 1948	1952	rundll32.exe	28
PID 1952 wrote to memory of 1948	1952	rundll32.exe	28
PID 1952 wrote to memory of 1948	1952	rundll32.exe	28
PID 1952 wrote to memory of 1948	1952	rundll32.exe	28
PID 1952 wrote to memory of 1948	1952	rundll32.exe	28
PID 1948 wrote to memory of 1420	1948	rundll32.exe	29
PID 1948 wrote to memory of 1420	1948	rundll32.exe	29
PID 1948 wrote to memory of 1420	1948	rundll32.exe	29
PID 1948 wrote to memory of 1420	1948	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\93f87175db325269c91845de9dd4e5980ce8f7c03fa1e9c63a5fd974bc8755f8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\93f87175db325269c91845de9dd4e5980ce8f7c03fa1e9c63a5fd974bc8755f8.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 228
    3⤵
    - Program crash
    PID:1420

memory/1948-55-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download