739131599711bc2f3ac880f39286d2b08fc5f9d6fe4014f1de9a51e321a6330b

Analysis

max time kernel
13s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 11:31

Target

739131599711bc2f3ac880f39286d2b08fc5f9d6fe4014f1de9a51e321a6330b.dll
Size

207KB
MD5

ee8feb158b61e0244679be7e4c31e7ac
SHA1

52d96e93d27675d6650b1ef523a2dc092dd7cf83
SHA256

739131599711bc2f3ac880f39286d2b08fc5f9d6fe4014f1de9a51e321a6330b
SHA512

ad54ebf0b119d5ae9e80907acb5a0b948360ee0a51a6294890242ac9c5c6c90d27b2e7e2bde9403d38c66bd557a8b526208d2ecccfcd8b8f323deef0d383c723
SSDEEP

6144:2NwOyNckjSz61wejuiUtkrNSbB9T1jL5p:ocq6jjuiUtYNSbjlL5p

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
612	1560	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1560	2032	rundll32.exe	28
PID 2032 wrote to memory of 1560	2032	rundll32.exe	28
PID 2032 wrote to memory of 1560	2032	rundll32.exe	28
PID 2032 wrote to memory of 1560	2032	rundll32.exe	28
PID 2032 wrote to memory of 1560	2032	rundll32.exe	28
PID 2032 wrote to memory of 1560	2032	rundll32.exe	28
PID 2032 wrote to memory of 1560	2032	rundll32.exe	28
PID 1560 wrote to memory of 612	1560	rundll32.exe	29
PID 1560 wrote to memory of 612	1560	rundll32.exe	29
PID 1560 wrote to memory of 612	1560	rundll32.exe	29
PID 1560 wrote to memory of 612	1560	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\739131599711bc2f3ac880f39286d2b08fc5f9d6fe4014f1de9a51e321a6330b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\739131599711bc2f3ac880f39286d2b08fc5f9d6fe4014f1de9a51e321a6330b.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 268
    3⤵
    - Program crash
    PID:612

memory/1560-55-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download
memory/1560-56-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download
memory/1560-57-0x00000000001F0000-0x00000000001F4000-memory.dmp

Filesize
16KB

Download
memory/1560-59-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download
memory/1560-60-0x0000000000780000-0x00000000007A5000-memory.dmp

Filesize
148KB

Download