f0b20525d97e39bb9f598cf2fb33fa75c8e4e302c4afc0fa2bddc3fa035210f5

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 11:25

Target

f0b20525d97e39bb9f598cf2fb33fa75c8e4e302c4afc0fa2bddc3fa035210f5.dll
Size

216KB
MD5

3e208db3e116a7b228747f420fa95ce1
SHA1

b848d89e79aec8763a841090c0536339c657dd5f
SHA256

f0b20525d97e39bb9f598cf2fb33fa75c8e4e302c4afc0fa2bddc3fa035210f5
SHA512

73ba879d6303e6b981385f4679c408ddd80d43d99da8a470be858fc173808d8e1d87271e613b5a9500841b9ddcc0b2da6b4814aa470868472bf62c2f617b3475
SSDEEP

3072:emnvIvjsmmhclUfrECdq6pamg3srY6H5GTfrFFzTUN+AtgUT5:qvon5bQmeeE5FzTk8y

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1356	1340	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28
PID 1652 wrote to memory of 1340	1652	rundll32.exe	28
PID 1340 wrote to memory of 1356	1340	rundll32.exe	29
PID 1340 wrote to memory of 1356	1340	rundll32.exe	29
PID 1340 wrote to memory of 1356	1340	rundll32.exe	29
PID 1340 wrote to memory of 1356	1340	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f0b20525d97e39bb9f598cf2fb33fa75c8e4e302c4afc0fa2bddc3fa035210f5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f0b20525d97e39bb9f598cf2fb33fa75c8e4e302c4afc0fa2bddc3fa035210f5.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 268
    3⤵
    - Program crash
    PID:1356

memory/1340-55-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download