f32ac928eff71bdc6d665932ae1fbc3e459a79ec5a0ff901baeb41d11d12f9d0

Analysis

max time kernel
13s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 11:21

Target

f32ac928eff71bdc6d665932ae1fbc3e459a79ec5a0ff901baeb41d11d12f9d0.dll
Size

1.8MB
MD5

96b45740576961087c259bfb430289c8
SHA1

73beab4f8da9660dc2a0ba5c1161ddc7c5f85011
SHA256

f32ac928eff71bdc6d665932ae1fbc3e459a79ec5a0ff901baeb41d11d12f9d0
SHA512

c4fe6ef4b0091a1e2bb959e894686e57203a1e2100f0ca0f3bf94b1a75541ce03106aca4aa8c6381830ea1d1e86be51670134078778e6b792ae33cf54cd4bd5d
SSDEEP

24576:igA3729AOae8cdO0jdhk5Ezq1CJDrwHb/IRTv78vvDu1fK9QFai:awAdeY0pho+q1sKIRTD8vcK9Ma

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
952	1784	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 1784	912	rundll32.exe	28
PID 912 wrote to memory of 1784	912	rundll32.exe	28
PID 912 wrote to memory of 1784	912	rundll32.exe	28
PID 912 wrote to memory of 1784	912	rundll32.exe	28
PID 912 wrote to memory of 1784	912	rundll32.exe	28
PID 912 wrote to memory of 1784	912	rundll32.exe	28
PID 912 wrote to memory of 1784	912	rundll32.exe	28
PID 1784 wrote to memory of 952	1784	rundll32.exe	29
PID 1784 wrote to memory of 952	1784	rundll32.exe	29
PID 1784 wrote to memory of 952	1784	rundll32.exe	29
PID 1784 wrote to memory of 952	1784	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f32ac928eff71bdc6d665932ae1fbc3e459a79ec5a0ff901baeb41d11d12f9d0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f32ac928eff71bdc6d665932ae1fbc3e459a79ec5a0ff901baeb41d11d12f9d0.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 240
    3⤵
    - Program crash
    PID:952

memory/1784-55-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download
memory/1784-57-0x0000000010000000-0x00000000101C4000-memory.dmp

Filesize
1.8MB

Download
memory/1784-58-0x00000000001C0000-0x00000000001CD000-memory.dmp

Filesize
52KB

Download
memory/1784-59-0x00000000001D0000-0x00000000001DD000-memory.dmp

Filesize
52KB

Download