d4b5e560d9af821642e4365193585aefcc03152e66b6d5060599f9335fccf7e9

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 12:24

Target

d4b5e560d9af821642e4365193585aefcc03152e66b6d5060599f9335fccf7e9.dll
Size

158KB
MD5

b38c36a4e4ffb898fcb400e529c235c2
SHA1

952c0377c4af0776b2726321b110969699ae937d
SHA256

d4b5e560d9af821642e4365193585aefcc03152e66b6d5060599f9335fccf7e9
SHA512

aeedf53a416e867497bcca25863211d25af2b1bb247af1313972eed818c9efde40a14a16fd4c8b2c1dc596d92fe9f771ad474ffc30154754f8b5b2b731271476
SSDEEP

1536:QgLIMoIVIJkuvfZ/Auw6sUB8BuegomYT/zkwqiQjvesIyX6+a8oO2Er5PpIHKKnX:QcKiyxvfGFueKETqiQ7hDRBGKK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
520	1716	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 1716	1008	rundll32.exe	28
PID 1008 wrote to memory of 1716	1008	rundll32.exe	28
PID 1008 wrote to memory of 1716	1008	rundll32.exe	28
PID 1008 wrote to memory of 1716	1008	rundll32.exe	28
PID 1008 wrote to memory of 1716	1008	rundll32.exe	28
PID 1008 wrote to memory of 1716	1008	rundll32.exe	28
PID 1008 wrote to memory of 1716	1008	rundll32.exe	28
PID 1716 wrote to memory of 520	1716	rundll32.exe	29
PID 1716 wrote to memory of 520	1716	rundll32.exe	29
PID 1716 wrote to memory of 520	1716	rundll32.exe	29
PID 1716 wrote to memory of 520	1716	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d4b5e560d9af821642e4365193585aefcc03152e66b6d5060599f9335fccf7e9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d4b5e560d9af821642e4365193585aefcc03152e66b6d5060599f9335fccf7e9.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 252
    3⤵
    - Program crash
    PID:520

memory/1716-55-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download
memory/1716-57-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download