b31ff5244d3d508e795622471bb25b91167de7861448153b01ccc6eae629330f

Analysis

max time kernel
36s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 07:05

Target

b31ff5244d3d508e795622471bb25b91167de7861448153b01ccc6eae629330f.dll
Size

440KB
MD5

8d9229bd4f23f6305b2e155d5ac3084f
SHA1

6ab6ea99f4aa38b62d79d7931d4d9ad9ab76e3ed
SHA256

b31ff5244d3d508e795622471bb25b91167de7861448153b01ccc6eae629330f
SHA512

fb74b714cc9599bbb60fa45afdd8de3feb2e7f91870b7e0e84ad5f19cd2164d90cc75c41fda111ba72d9a17ac231ece8db0b9772213e8ab0bfe5f3a76e5b9ff5
SSDEEP

12288:NcnQ9PUA1PbMfjHkOFTsrjcCBJ0msTz8H:qnasAVbMfjPOw0kTIH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1736	2004	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26
PID 1608 wrote to memory of 2004	1608	rundll32.exe	26
PID 2004 wrote to memory of 1736	2004	rundll32.exe	27
PID 2004 wrote to memory of 1736	2004	rundll32.exe	27
PID 2004 wrote to memory of 1736	2004	rundll32.exe	27
PID 2004 wrote to memory of 1736	2004	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b31ff5244d3d508e795622471bb25b91167de7861448153b01ccc6eae629330f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b31ff5244d3d508e795622471bb25b91167de7861448153b01ccc6eae629330f.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 256
    3⤵
    - Program crash
    PID:1736

memory/2004-55-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download
memory/2004-56-0x00000000008D0000-0x0000000000941000-memory.dmp

Filesize
452KB

Download
memory/2004-60-0x0000000000200000-0x000000000025E000-memory.dmp

Filesize
376KB

Download