d19c7f3246e0c6af2368416b1dc92ecd0fdb5145275e0818a2353d8e55d15491

Analysis

max time kernel
32s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 04:17

Target

d19c7f3246e0c6af2368416b1dc92ecd0fdb5145275e0818a2353d8e55d15491.dll
Size

268KB
MD5

56ab6b39fef2ba1201b90186d88017cf
SHA1

37b3e5b876905fc3a5528899fbdafa05c6b15234
SHA256

d19c7f3246e0c6af2368416b1dc92ecd0fdb5145275e0818a2353d8e55d15491
SHA512

57dfc8bea178b50ed4787daf4311418973048ffcdcb6474f660614808eb58261137f9f5ce63b76cad12e90cc3544066c271ffdfc162c0e4cff89f4be96a11c03
SSDEEP

6144:LlNtmNe53rwSoV6Ict9tcKuhRyipeeJuX4G0:5yNErwSoV6nt96Ku3tJa4G0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
956	952	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 952	960	rundll32.exe	28
PID 960 wrote to memory of 952	960	rundll32.exe	28
PID 960 wrote to memory of 952	960	rundll32.exe	28
PID 960 wrote to memory of 952	960	rundll32.exe	28
PID 960 wrote to memory of 952	960	rundll32.exe	28
PID 960 wrote to memory of 952	960	rundll32.exe	28
PID 960 wrote to memory of 952	960	rundll32.exe	28
PID 952 wrote to memory of 956	952	rundll32.exe	29
PID 952 wrote to memory of 956	952	rundll32.exe	29
PID 952 wrote to memory of 956	952	rundll32.exe	29
PID 952 wrote to memory of 956	952	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d19c7f3246e0c6af2368416b1dc92ecd0fdb5145275e0818a2353d8e55d15491.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d19c7f3246e0c6af2368416b1dc92ecd0fdb5145275e0818a2353d8e55d15491.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 228
    3⤵
    - Program crash
    PID:956

memory/952-55-0x0000000075591000-0x0000000075593000-memory.dmp

Filesize
8KB

Download
memory/952-56-0x0000000000200000-0x0000000000246000-memory.dmp

Filesize
280KB

Download
memory/952-60-0x0000000000160000-0x0000000000194000-memory.dmp

Filesize
208KB

Download